diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index cdca5a3cd0..2619eff65c 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -70,7 +70,7 @@ s3transfer==0.3.4 six==1.13.0 smmap==3.0.5 splunk-sdk==1.6.15 -tabulate==0.8.8 +tabulate==0.8.9 termcolor==1.1.0 toml==0.10.2 urllib3==1.26.3 diff --git a/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml index 253891d97d..0da01c6449 100644 --- a/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml +++ b/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml @@ -17,8 +17,8 @@ how_to_implement: This search is specific to Okta and requires Okta logs are bei ingested in your Splunk deployment. known_false_positives: A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too - low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise - the threshold or except specific IP adresses from triggering this search. + low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` + to raise the threshold or except specific IP adresses from triggering this search. references: [] tags: analytic_story: diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index 1a5234bb90..12cbf5c08b 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -36,8 +36,8 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json mitre_attack_id: - T1078 - security_domain: threat product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: threat diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index fdefa32002..dcb2dc6493 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -32,8 +32,8 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json mitre_attack_id: - T1078 - security_domain: threat product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: threat diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index d3fb9a40cb..216d2d9ccd 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -32,8 +32,8 @@ tags: - Actions on Objective mitre_attack_id: - T1136.003 - security_domain: threat product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: threat diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index feb1dfc3ea..02c1ab2d47 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -35,8 +35,8 @@ tags: - Actions on Objective mitre_attack_id: - T1136.003 - security_domain: threat product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: threat diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index ce4f398b72..cb3a984dda 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -30,8 +30,8 @@ tags: - Actions on Objective mitre_attack_id: - T1556 - security_domain: threat product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: threat diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 21eb289874..9de591d753 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -34,8 +34,8 @@ tags: - Actions on Objective mitre_attack_id: - T1136.003 - security_domain: threat product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: threat diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index d92b1af1ae..ec5e0c3d65 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -29,8 +29,8 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log kill_chain_phases: - Installation - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 0cf5fe9399..40d59d147a 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -42,8 +42,8 @@ tags: - T1003.001 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 1da256b8b4..351f023936 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -39,8 +39,8 @@ tags: - T1003.003 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index bbb45f9eeb..22253f2252 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -2,6 +2,9 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 version: 1 date: '2021-02-11' +author: Michael Haag, Splunk +type: batch +datamodel: [] description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -13,32 +16,33 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed hh.exe may be used. -type: batch -datamodel: [] -references: -- https://attack.mitre.org/techniques/T1218/001/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md -- https://lolbas-project.github.io/lolbas/Binaries/Hh/ -author: Michael Haag, Splunk search: '`sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed hh.exe may be used. known_false_positives: Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. +references: +- https://attack.mitre.org/techniques/T1218/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md +- https://lolbas-project.github.io/lolbas/Binaries/Hh/ tags: analytic_story: - Suspicious Compiled HTML Activity - mitre_attack_id: - - T1218.001 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.001 nist: - PR.PT - DE.CM @@ -47,7 +51,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index a955571928..cc5e047ef1 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -2,41 +2,50 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b version: 1 date: '2021-02-11' -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. - This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. - Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. - The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. - During investigation, identify script content origination. Review child process events and investigate further. - hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. +author: Michael Haag, Splunk type: batch datamodel: - Endpoint +description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled + HTML Help (CHM) that spawns a child process. This particular technique will load + Windows script code from a compiled help file. CHM files may contain nearly any + file type embedded, but only execute html/htm. Upon a successful execution, the + following script engines may be used for execution - JScript, VBScript, VBScript.Encode, + JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll + loading into hh.exe upon execution. The "htm" and "html" file extensions were the + only extensions observed to be supported for the execution of Shortcut commands + or WSH script code. During investigation, identify script content origination. Review + child process events and investigate further. hh.exe is natively found in C:\Windows\system32 + and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) + may spawn a child process. Filter as needed. references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -author: Michael Haag, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`' -known_false_positives: Although unlikely, some legitimate applications (ex. web browsers) - may spawn a child process. Filter as needed. tags: analytic_story: - Suspicious Compiled HTML Activity - mitre_attack_id: - - T1218.001 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.001 nist: - PR.PT - DE.CM @@ -45,7 +54,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 61dbf860d2..794e909fe2 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,20 +2,32 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 1 date: '2021-02-11' -description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. - This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. - Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. - The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. - During investigation, identify script content origination. - Review reputation of remote IP and domain. - Some instances, it is worth decompiling the .chm file to review its original contents. - hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. +author: Michael Haag, Splunk type: batch datamodel: - Endpoint +description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled + HTML Help (CHM) file from a remote url. This particular technique will load Windows + script code from a compiled help file. CHM files may contain nearly any file type + embedded, but only execute html/htm. Upon a successful execution, the following + script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, + JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe + upon execution. The "htm" and "html" file extensions were the only extensions observed + to be supported for the execution of Shortcut commands or WSH script code. During + investigation, identify script content origination. Review reputation of remote + IP and domain. Some instances, it is worth decompiling the .chm file to review its + original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe + Processes.process=*http* by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_html_help_url_in_command_line_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Although unlikely, some legitimate applications may retrieve + a CHM remotely, filter as needed. references: - https://attack.mitre.org/techniques/T1218/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md @@ -23,23 +35,19 @@ references: - https://blog.sevagas.com/?Hacking-around-HTA-files - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -author: Michael Haag, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe - Processes.process=*http* by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_html_help_url_in_command_line_filter`' -known_false_positives: Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. tags: analytic_story: - Suspicious Compiled HTML Activity - mitre_attack_id: - - T1218.001 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.001 nist: - PR.PT - DE.CM @@ -48,7 +56,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index e1e51fc74e..93e7d38421 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -2,6 +2,10 @@ name: Detect HTML Help Using InfoTech Storage Handlers id: 0b2eefa5-5508-450d-b970-3dd2fb761aec version: 1 date: '2021-02-11' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage @@ -15,12 +19,17 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe + Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -type: batch -datamodel: -- Endpoint +known_false_positives: It is rare to see instances of InfoTech Storage Handlers being + used, but it does happen in some legitimate instances. Filter as needed. references: - https://attack.mitre.org/techniques/T1218/001/ - https://www.kb.cert.org/vuls/id/851869 @@ -28,24 +37,19 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ -author: Michael Haag, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe - Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter`' -known_false_positives: It is rare to see instances of InfoTech Storage Handlers being - used, but it does happen in some legitimate instances. Filter as needed. tags: analytic_story: - Suspicious Compiled HTML Activity - mitre_attack_id: - - T1218.001 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.001 nist: - PR.PT - DE.CM @@ -54,7 +58,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index fc17561571..a00804b246 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -2,6 +2,10 @@ name: Detect Regasm Spawning a Process id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f version: 1 date: '2021-02-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint description: The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process @@ -10,35 +14,35 @@ description: The following analytic identifies regasm.exe spawning a process. Th suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -type: batch -datamodel: -- Endpoint -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -author: Michael Haag, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ +- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity - mitre_attack_id: - - T1218.009 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.009 nist: - PR.PT - DE.CM @@ -47,7 +51,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index d41494118e..0af1359b18 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -2,6 +2,9 @@ name: Detect Regasm with Network Connection id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f version: 1 date: '2021-02-16' +author: Michael Haag, Splunk +type: batch +datamodel: [] description: The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe @@ -12,33 +15,34 @@ description: The following analytic identifies regasm.exe with a network connect and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -type: batch -datamodel: [] -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -author: Michael Haag, Splunk search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. known_false_positives: Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity - mitre_attack_id: - - T1218.009 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.009 nist: - PR.PT - DE.CM @@ -47,7 +51,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 3e78c7c5e2..96ca12e9ba 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -2,40 +2,44 @@ name: Detect Regasm with no Command Line Arguments id: c3bc1430-04e7-4178-835f-047d8e6e97df version: 1 date: '2021-02-12' +author: Michael Haag, Splunk +type: batch +datamodel: [] description: The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -type: batch -datamodel: [] -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ -author: Michael Haag, Splunk search: '`sysmon` EventID=1 (process_name=regasm.exe OR OriginalFileName=RegAsm.exe) | regex CommandLine="(regasm\.exe.{0,4}$)" | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. known_false_positives: Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regasm/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity - mitre_attack_id: - - T1218.009 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.009 nist: - PR.PT - DE.CM @@ -44,7 +48,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index ac3de23dbb..bf9ff231cd 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -2,6 +2,10 @@ name: Detect Regsvcs Spawning a Process id: bc477b57-5c21-4ab6-9c33-668772e7f114 version: 1 date: '2021-02-12' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint description: The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process @@ -10,34 +14,34 @@ description: The following analytic identifies regsvcs.exe spawning a process. T suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -type: batch -datamodel: -- Endpoint -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -author: Michael Haag, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity - mitre_attack_id: - - T1218.009 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.009 nist: - PR.PT - DE.CM @@ -46,7 +50,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index a1faacda99..8201d1ffea 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -2,6 +2,9 @@ name: Detect Regsvcs with Network Connection id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a version: 1 date: '2021-02-16' +author: Michael Haag, Splunk +type: batch +datamodel: [] description: The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe @@ -12,33 +15,34 @@ description: The following analytic identifies Regsvcs.exe with a network connec and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -type: batch -datamodel: [] -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -author: Michael Haag, Splunk search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity - mitre_attack_id: - - T1218.009 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.009 nist: - PR.PT - DE.CM @@ -47,7 +51,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: Endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 4e7bac0495..bb3be4d732 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -2,40 +2,44 @@ name: Detect Regsvcs with No Command Line Arguments id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 version: 1 date: '2021-02-12' +author: Michael Haag, Splunk +type: batch +datamodel: [] description: The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -type: batch -datamodel: [] -references: -- https://attack.mitre.org/techniques/T1218/009/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md -- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ -author: Michael Haag, Splunk search: '`sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvcs.exe) | regex CommandLine="(regsvcs\.exe.{0,4}$)" | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +references: +- https://attack.mitre.org/techniques/T1218/009/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md +- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/ tags: analytic_story: - Suspicious Regsvcs Regasm Activity - mitre_attack_id: - - T1218.009 - kill_chain_phases: - - Actions on Objectives + asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1218.009 nist: - PR.PT - DE.CM @@ -44,7 +48,3 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - asset_type: Endpoint - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log - automated_detection_testing: passed diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 8fe28bc168..bb8e357082 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -49,8 +49,8 @@ tags: - T1218.010 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index cbce008255..5c0b460a46 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -47,8 +47,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index b1c6165425..274bf9990e 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -47,8 +47,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index ba2468553e..442b6b21b4 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -47,8 +47,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index f91f46fca9..7c2425cc66 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -38,8 +38,8 @@ tags: - T1003.001 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index d1e67bcf07..168bf52b29 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -46,8 +46,8 @@ tags: - T1003.001 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index 44ee9b9808..a3134f16e9 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -44,8 +44,8 @@ tags: - T1003.001 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index ce423c9ec8..850fadeee6 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -50,8 +50,8 @@ tags: - T1003.003 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 929bdc172f..0fb2843236 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -21,8 +21,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` ' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint - data sources, such as Sysmon. + via endpoint detection-and-response product, such as Carbon Black, or endpoint data + sources, such as Sysmon. known_false_positives: This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories. references: diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 74371474eb..c0e07b6608 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -46,8 +46,8 @@ tags: - T1218.010 nist: - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 69fadc40c4..cf186d2108 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -49,8 +49,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index 2e8b52dbde..86a5d478f8 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -43,8 +43,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index fc3e3373a7..7ea978a948 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -7,8 +7,8 @@ type: batch datamodel: - Endpoint description: The following analytic identifies rundll32.exe executing a DLL function - name, Start and StartW, on the command line that is commonly observed with Cobalt Strike - x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 + name, Start and StartW, on the command line that is commonly observed with Cobalt + Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application @@ -49,8 +49,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index 94736b68cc..7c062b319c 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -44,8 +44,8 @@ tags: nist: - PR.PT - DE.CM - security_domain: endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + security_domain: endpoint diff --git a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml index 2ae04051cd..119e697c68 100644 --- a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml +++ b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml @@ -25,8 +25,8 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max( != "" | `detect_oulook_exe_writing_a__zip_file_filter` ' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated - via endpoint detection-and-response product, such as Carbon Black, or endpoint - data sources, such as Sysmon. + via endpoint detection-and-response product, such as Carbon Black, or endpoint data + sources, such as Sysmon. known_false_positives: It is not uncommon for outlook to write legitimate zip files to the disk. references: [] diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index 910792e95b..29c3b96a94 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -18,7 +18,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -33,7 +40,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -212,8 +219,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -224,7 +231,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -316,13 +323,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -479,7 +489,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -496,7 +508,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -514,12 +529,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -550,7 +567,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -561,11 +579,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -591,7 +610,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -674,7 +698,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -709,11 +733,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -750,7 +775,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -801,7 +827,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -816,7 +849,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -995,8 +1028,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -1007,7 +1040,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -1099,13 +1132,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -1262,7 +1298,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -1279,7 +1317,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -1297,12 +1338,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -1333,7 +1376,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -1344,11 +1388,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -1374,7 +1419,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -1457,7 +1507,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -1492,11 +1542,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -1533,7 +1584,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -1584,7 +1636,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -1599,7 +1658,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -1778,8 +1837,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -1790,7 +1849,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -1882,13 +1941,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -2045,7 +2107,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -2062,7 +2126,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -2080,12 +2147,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -2116,7 +2185,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -2127,11 +2197,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -2157,7 +2228,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -2240,7 +2316,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -2275,11 +2351,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -2316,7 +2393,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -2367,7 +2445,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -2382,7 +2467,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -2561,8 +2646,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -2573,7 +2658,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -2665,13 +2750,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -2828,7 +2916,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -2845,7 +2935,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -2863,12 +2956,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -2899,7 +2994,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -2910,11 +3006,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -2940,7 +3037,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -3023,7 +3125,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -3058,11 +3160,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -3099,7 +3202,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -3150,7 +3254,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -3165,7 +3276,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -3344,8 +3455,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -3356,7 +3467,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -3448,13 +3559,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -3611,7 +3725,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -3628,7 +3744,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -3646,12 +3765,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -3682,7 +3803,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -3693,11 +3815,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -3723,7 +3846,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -3806,7 +3934,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -3841,11 +3969,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -3882,7 +4011,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -3933,7 +4063,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -3948,7 +4085,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -4127,8 +4264,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -4139,7 +4276,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -4231,13 +4368,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -4394,7 +4534,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -4411,7 +4553,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -4429,12 +4574,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -4465,7 +4612,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -4476,11 +4624,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -4506,7 +4655,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -4589,7 +4743,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -4624,11 +4778,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -4665,7 +4820,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -4716,7 +4872,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -4731,7 +4894,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -4910,8 +5073,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -4922,7 +5085,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -5014,13 +5177,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -5177,7 +5343,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -5194,7 +5362,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -5212,12 +5383,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -5248,7 +5421,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -5259,11 +5433,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -5289,7 +5464,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -5372,7 +5552,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -5407,11 +5587,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -5448,7 +5629,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -5499,7 +5681,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -5514,7 +5703,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -5693,8 +5882,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -5705,7 +5894,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -5797,13 +5986,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -5960,7 +6152,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -5977,7 +6171,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -5995,12 +6192,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -6031,7 +6230,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -6042,11 +6242,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -6072,7 +6273,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -6155,7 +6361,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -6190,11 +6396,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -6231,7 +6438,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -6282,7 +6490,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -6297,7 +6512,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -6476,8 +6691,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -6488,7 +6703,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -6580,13 +6795,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -6743,7 +6961,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -6760,7 +6980,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -6778,12 +7001,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -6814,7 +7039,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -6825,11 +7051,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -6855,7 +7082,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -6938,7 +7170,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -6973,11 +7205,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -7014,7 +7247,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -7065,7 +7299,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -7080,7 +7321,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -7259,8 +7500,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -7271,7 +7512,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -7363,13 +7604,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -7526,7 +7770,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -7543,7 +7789,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -7561,12 +7810,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -7597,7 +7848,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -7608,11 +7860,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -7638,7 +7891,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -7721,7 +7979,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -7756,11 +8014,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -7797,7 +8056,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -7848,7 +8108,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -7863,7 +8130,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -8042,8 +8309,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -8054,7 +8321,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -8146,13 +8413,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -8309,7 +8579,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -8326,7 +8598,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -8344,12 +8619,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -8380,7 +8657,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -8391,11 +8669,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -8421,7 +8700,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -8504,7 +8788,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -8539,11 +8823,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -8580,7 +8865,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -8631,7 +8917,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -8646,7 +8939,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -8825,8 +9118,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -8837,7 +9130,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -8929,13 +9222,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -9092,7 +9388,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -9109,7 +9407,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -9127,12 +9428,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -9163,7 +9466,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -9174,11 +9478,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -9204,7 +9509,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -9287,7 +9597,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -9322,11 +9632,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -9363,7 +9674,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -9414,7 +9726,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -9429,7 +9748,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -9608,8 +9927,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -9620,7 +9939,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -9712,13 +10031,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -9875,7 +10197,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -9892,7 +10216,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -9910,12 +10237,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -9946,7 +10275,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -9957,11 +10287,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -9987,7 +10318,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -10070,7 +10406,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -10105,11 +10441,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -10146,7 +10483,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -10197,7 +10535,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -10212,7 +10557,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -10391,8 +10736,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -10403,7 +10748,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -10495,13 +10840,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -10658,7 +11006,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -10675,7 +11025,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -10693,12 +11046,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -10729,7 +11084,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -10740,11 +11096,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -10770,7 +11127,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -10853,7 +11215,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -10888,11 +11250,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -10929,7 +11292,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -10980,7 +11344,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -10995,7 +11366,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -11174,8 +11545,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -11186,7 +11557,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -11278,13 +11649,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -11441,7 +11815,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -11458,7 +11834,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -11476,12 +11855,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -11512,7 +11893,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -11523,11 +11905,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -11553,7 +11936,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -11636,7 +12024,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -11671,11 +12059,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -11712,7 +12101,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -11763,7 +12153,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -11778,7 +12175,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -11957,8 +12354,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -11969,7 +12366,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -12061,13 +12458,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -12224,7 +12624,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -12241,7 +12643,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -12259,12 +12664,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -12295,7 +12702,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -12306,11 +12714,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -12336,7 +12745,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -12419,7 +12833,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -12454,11 +12868,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -12495,7 +12910,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -12546,7 +12962,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -12561,7 +12984,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -12740,8 +13163,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -12752,7 +13175,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -12844,13 +13267,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -13007,7 +13433,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -13024,7 +13452,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -13042,12 +13473,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -13078,7 +13511,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -13089,11 +13523,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -13119,7 +13554,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -13202,7 +13642,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -13237,11 +13677,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -13278,7 +13719,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -13329,7 +13771,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -13344,7 +13793,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -13523,8 +13972,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -13535,7 +13984,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -13627,13 +14076,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -13790,7 +14242,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -13807,7 +14261,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -13825,12 +14282,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -13861,7 +14320,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -13872,11 +14332,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -13902,7 +14363,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -13985,7 +14451,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -14020,11 +14486,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -14061,7 +14528,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -14112,7 +14580,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -14127,7 +14602,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -14306,8 +14781,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -14318,7 +14793,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -14410,13 +14885,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -14573,7 +15051,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -14590,7 +15070,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -14608,12 +15091,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -14644,7 +15129,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -14655,11 +15141,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -14685,7 +15172,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -14768,7 +15260,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -14803,11 +15295,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -14844,7 +15337,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -14895,7 +15389,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -14910,7 +15411,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -15089,8 +15590,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -15101,7 +15602,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -15193,13 +15694,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -15356,7 +15860,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -15373,7 +15879,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -15391,12 +15900,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -15427,7 +15938,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -15438,11 +15950,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -15468,7 +15981,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -15551,7 +16069,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -15586,11 +16104,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -15627,7 +16146,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -15678,7 +16198,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -15693,7 +16220,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -15872,8 +16399,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -15884,7 +16411,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -15976,13 +16503,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -16139,7 +16669,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -16156,7 +16688,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -16174,12 +16709,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -16210,7 +16747,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -16221,11 +16759,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -16251,7 +16790,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -16334,7 +16878,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -16369,11 +16913,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -16410,7 +16955,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -16461,7 +17007,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -16476,7 +17029,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -16655,8 +17208,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -16667,7 +17220,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -16759,13 +17312,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -16922,7 +17478,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -16939,7 +17497,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -16957,12 +17518,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -16993,7 +17556,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -17004,11 +17568,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -17034,7 +17599,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -17117,7 +17687,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -17152,11 +17722,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -17193,7 +17764,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -17244,7 +17816,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -17259,7 +17838,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -17438,8 +18017,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -17450,7 +18029,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -17542,13 +18121,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -17705,7 +18287,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -17722,7 +18306,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -17740,12 +18327,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -17776,7 +18365,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -17787,11 +18377,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -17817,7 +18408,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -17900,7 +18496,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -17935,11 +18531,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -17976,7 +18573,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -18027,7 +18625,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -18042,7 +18647,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -18221,8 +18826,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -18233,7 +18838,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -18325,13 +18930,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -18488,7 +19096,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -18505,7 +19115,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -18523,12 +19136,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -18559,7 +19174,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -18570,11 +19186,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -18600,7 +19217,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -18683,7 +19305,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -18718,11 +19340,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -18759,7 +19382,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -18810,7 +19434,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -18825,7 +19456,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -19004,8 +19635,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -19016,7 +19647,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -19108,13 +19739,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -19271,7 +19905,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -19288,7 +19924,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -19306,12 +19945,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -19342,7 +19983,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -19353,11 +19995,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -19383,7 +20026,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -19466,7 +20114,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -19501,11 +20149,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -19542,7 +20191,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -19593,7 +20243,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -19608,7 +20265,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -19787,8 +20444,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -19799,7 +20456,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -19891,13 +20548,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -20054,7 +20714,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -20071,7 +20733,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -20089,12 +20754,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -20125,7 +20792,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -20136,11 +20804,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -20166,7 +20835,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -20249,7 +20923,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -20284,11 +20958,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -20325,7 +21000,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -20376,7 +21052,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -20391,7 +21074,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -20570,8 +21253,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -20582,7 +21265,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -20674,13 +21357,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -20837,7 +21523,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -20854,7 +21542,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -20872,12 +21563,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -20908,7 +21601,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -20919,11 +21613,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -20949,7 +21644,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -21032,7 +21732,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -21067,11 +21767,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -21108,7 +21809,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -21159,7 +21861,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -21174,7 +21883,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -21353,8 +22062,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -21365,7 +22074,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -21457,13 +22166,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -21620,7 +22332,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -21637,7 +22351,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -21655,12 +22372,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -21691,7 +22410,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -21702,11 +22422,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -21732,7 +22453,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -21815,7 +22541,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -21850,11 +22576,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -21891,7 +22618,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -21942,7 +22670,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -21957,7 +22692,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -22136,8 +22871,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -22148,7 +22883,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -22240,13 +22975,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -22403,7 +23141,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -22420,7 +23160,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -22438,12 +23181,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -22474,7 +23219,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -22485,11 +23231,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -22515,7 +23262,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -22598,7 +23350,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -22633,11 +23385,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -22674,7 +23427,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -22725,7 +23479,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -22740,7 +23501,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -22919,8 +23680,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -22931,7 +23692,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -23023,13 +23784,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -23186,7 +23950,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -23203,7 +23969,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -23221,12 +23990,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -23257,7 +24028,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -23268,11 +24040,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -23298,7 +24071,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -23381,7 +24159,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -23416,11 +24194,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -23457,7 +24236,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -23508,7 +24288,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -23523,7 +24310,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -23702,8 +24489,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -23714,7 +24501,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -23806,13 +24593,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -23969,7 +24759,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -23986,7 +24778,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -24004,12 +24799,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -24040,7 +24837,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -24051,11 +24849,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -24081,7 +24880,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -24164,7 +24968,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -24199,11 +25003,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -24240,7 +25045,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -24291,7 +25097,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -24306,7 +25119,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -24485,8 +25298,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -24497,7 +25310,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -24589,13 +25402,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -24752,7 +25568,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -24769,7 +25587,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -24787,12 +25608,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -24823,7 +25646,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -24834,11 +25658,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -24864,7 +25689,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -24947,7 +25777,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -24982,11 +25812,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -25023,7 +25854,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -25074,7 +25906,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -25089,7 +25928,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -25268,8 +26107,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -25280,7 +26119,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -25372,13 +26211,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -25535,7 +26377,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -25552,7 +26396,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -25570,12 +26417,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -25606,7 +26455,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -25617,11 +26467,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -25647,7 +26498,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -25730,7 +26586,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -25765,11 +26621,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -25806,7 +26663,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -25857,7 +26715,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -25872,7 +26737,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -26051,8 +26916,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -26063,7 +26928,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -26155,13 +27020,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -26318,7 +27186,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -26335,7 +27205,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -26353,12 +27226,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -26389,7 +27264,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -26400,11 +27276,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -26430,7 +27307,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -26513,7 +27395,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -26548,11 +27430,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -26589,7 +27472,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -26640,7 +27524,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -26655,7 +27546,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -26834,8 +27725,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -26846,7 +27737,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -26938,13 +27829,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -27101,7 +27995,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -27118,7 +28014,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -27136,12 +28035,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -27172,7 +28073,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -27183,11 +28085,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -27213,7 +28116,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -27296,7 +28204,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -27331,11 +28239,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -27372,7 +28281,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -27423,7 +28333,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -27438,7 +28355,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -27617,8 +28534,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -27629,7 +28546,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -27721,13 +28638,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -27884,7 +28804,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -27901,7 +28823,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -27919,12 +28844,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -27955,7 +28882,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -27966,11 +28894,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -27996,7 +28925,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -28079,7 +29013,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -28114,11 +29048,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -28155,7 +29090,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -28206,7 +29142,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -28221,7 +29164,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -28400,8 +29343,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -28412,7 +29355,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -28504,13 +29447,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -28667,7 +29613,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -28684,7 +29632,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -28702,12 +29653,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -28738,7 +29691,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -28749,11 +29703,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -28779,7 +29734,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -28862,7 +29822,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -28897,11 +29857,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -28938,7 +29899,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -28989,7 +29951,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -29004,7 +29973,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -29183,8 +30152,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -29195,7 +30164,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -29287,13 +30256,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -29450,7 +30422,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -29467,7 +30441,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -29485,12 +30462,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -29521,7 +30500,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -29532,11 +30512,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -29562,7 +30543,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -29645,7 +30631,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -29680,11 +30666,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -29721,7 +30708,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -29772,7 +30760,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -29787,7 +30782,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -29966,8 +30961,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -29978,7 +30973,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -30070,13 +31065,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -30233,7 +31231,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -30250,7 +31250,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -30268,12 +31271,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -30304,7 +31309,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -30315,11 +31321,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -30345,7 +31352,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -30428,7 +31440,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -30463,11 +31475,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -30504,7 +31517,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -30555,7 +31569,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -30570,7 +31591,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -30749,8 +31770,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -30761,7 +31782,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -30853,13 +31874,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -31016,7 +32040,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -31033,7 +32059,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -31051,12 +32080,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -31087,7 +32118,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -31098,11 +32130,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -31128,7 +32161,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -31211,7 +32249,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -31246,11 +32284,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -31287,7 +32326,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -31338,7 +32378,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -31353,7 +32400,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -31532,8 +32579,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -31544,7 +32591,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -31636,13 +32683,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -31799,7 +32849,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -31816,7 +32868,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -31834,12 +32889,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -31870,7 +32927,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -31881,11 +32939,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -31911,7 +32970,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -31994,7 +33058,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -32029,11 +33093,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -32070,7 +33135,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -32121,7 +33187,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -32136,7 +33209,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -32315,8 +33388,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -32327,7 +33400,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -32419,13 +33492,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -32582,7 +33658,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -32599,7 +33677,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -32617,12 +33698,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -32653,7 +33736,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -32664,11 +33748,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -32694,7 +33779,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -32777,7 +33867,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -32812,11 +33902,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -32853,7 +33944,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -32904,7 +33996,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -32919,7 +34018,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -33098,8 +34197,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -33110,7 +34209,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -33202,13 +34301,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -33365,7 +34467,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -33382,7 +34486,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -33400,12 +34507,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -33436,7 +34545,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -33447,11 +34557,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -33477,7 +34588,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -33560,7 +34676,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -33595,11 +34711,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -33636,7 +34753,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -33687,7 +34805,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -33702,7 +34827,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -33881,8 +35006,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -33893,7 +35018,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -33985,13 +35110,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -34148,7 +35276,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -34165,7 +35295,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -34183,12 +35316,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -34219,7 +35354,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -34230,11 +35366,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -34260,7 +35397,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -34343,7 +35485,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -34378,11 +35520,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -34419,7 +35562,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -34470,7 +35614,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -34485,7 +35636,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -34664,8 +35815,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -34676,7 +35827,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -34768,13 +35919,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -34931,7 +36085,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -34948,7 +36104,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -34966,12 +36125,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -35002,7 +36163,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -35013,11 +36175,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -35043,7 +36206,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -35126,7 +36294,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -35161,11 +36329,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -35202,7 +36371,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -35253,7 +36423,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -35268,7 +36445,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -35447,8 +36624,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -35459,7 +36636,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -35551,13 +36728,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -35714,7 +36894,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -35731,7 +36913,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -35749,12 +36934,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -35785,7 +36972,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -35796,11 +36984,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -35826,7 +37015,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -35909,7 +37103,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -35944,11 +37138,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -35985,7 +37180,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -36036,7 +37232,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -36051,7 +37254,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -36230,8 +37433,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -36242,7 +37445,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -36334,13 +37537,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -36497,7 +37703,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -36514,7 +37722,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -36532,12 +37743,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -36568,7 +37781,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -36579,11 +37793,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -36609,7 +37824,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -36692,7 +37912,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -36727,11 +37947,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -36768,7 +37989,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -36819,7 +38041,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -36834,7 +38063,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -37013,8 +38242,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -37025,7 +38254,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -37117,13 +38346,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -37280,7 +38512,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -37297,7 +38531,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -37315,12 +38552,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -37351,7 +38590,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -37362,11 +38602,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -37392,7 +38633,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -37475,7 +38721,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -37510,11 +38756,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -37551,7 +38798,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -37602,7 +38850,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -37617,7 +38872,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -37796,8 +39051,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -37808,7 +39063,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -37900,13 +39155,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -38063,7 +39321,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -38080,7 +39340,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -38098,12 +39361,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -38134,7 +39399,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -38145,11 +39411,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -38175,7 +39442,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -38258,7 +39530,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -38293,11 +39565,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -38334,7 +39607,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -38385,7 +39659,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -38400,7 +39681,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -38579,8 +39860,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -38591,7 +39872,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -38683,13 +39964,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -38846,7 +40130,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -38863,7 +40149,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -38881,12 +40170,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -38917,7 +40208,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -38928,11 +40220,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -38958,7 +40251,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -39041,7 +40339,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -39076,11 +40374,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -39117,7 +40416,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -39168,7 +40468,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -39183,7 +40490,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -39362,8 +40669,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -39374,7 +40681,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -39466,13 +40773,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -39629,7 +40939,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -39646,7 +40958,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -39664,12 +40979,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -39700,7 +41017,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -39711,11 +41029,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -39741,7 +41060,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -39824,7 +41148,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -39859,11 +41183,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -39900,7 +41225,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -39951,7 +41277,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -39966,7 +41299,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -40145,8 +41478,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -40157,7 +41490,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -40249,13 +41582,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -40412,7 +41748,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -40429,7 +41767,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -40447,12 +41788,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -40483,7 +41826,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -40494,11 +41838,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -40524,7 +41869,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -40607,7 +41957,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -40642,11 +41992,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -40683,7 +42034,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -40734,7 +42086,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -40749,7 +42108,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -40928,8 +42287,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -40940,7 +42299,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -41032,13 +42391,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -41195,7 +42557,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -41212,7 +42576,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -41230,12 +42597,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -41266,7 +42635,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -41277,11 +42647,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -41307,7 +42678,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -41390,7 +42766,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -41425,11 +42801,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -41466,7 +42843,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -41517,7 +42895,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -41532,7 +42917,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -41711,8 +43096,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -41723,7 +43108,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -41815,13 +43200,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -41978,7 +43366,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -41995,7 +43385,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -42013,12 +43406,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -42049,7 +43444,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -42060,11 +43456,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -42090,7 +43487,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -42173,7 +43575,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -42208,11 +43610,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -42249,7 +43652,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -42300,7 +43704,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -42315,7 +43726,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -42494,8 +43905,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -42506,7 +43917,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -42598,13 +44009,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -42761,7 +44175,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -42778,7 +44194,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -42796,12 +44215,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -42832,7 +44253,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -42843,11 +44265,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -42873,7 +44296,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -42956,7 +44384,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -42991,11 +44419,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -43032,7 +44461,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -43083,7 +44513,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -43098,7 +44535,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -43277,8 +44714,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -43289,7 +44726,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -43381,13 +44818,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -43544,7 +44984,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -43561,7 +45003,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -43579,12 +45024,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -43615,7 +45062,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -43626,11 +45074,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -43656,7 +45105,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -43739,7 +45193,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -43774,11 +45228,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -43815,7 +45270,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -43866,7 +45322,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -43881,7 +45344,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -44060,8 +45523,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -44072,7 +45535,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -44164,13 +45627,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -44327,7 +45793,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -44344,7 +45812,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -44362,12 +45833,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -44398,7 +45871,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -44409,11 +45883,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -44439,7 +45914,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -44522,7 +46002,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -44557,11 +46037,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -44598,7 +46079,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -44649,7 +46131,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -44664,7 +46153,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -44843,8 +46332,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -44855,7 +46344,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -44947,13 +46436,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -45110,7 +46602,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -45127,7 +46621,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -45145,12 +46642,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -45181,7 +46680,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -45192,11 +46692,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -45222,7 +46723,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -45305,7 +46811,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -45340,11 +46846,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -45381,7 +46888,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -45432,7 +46940,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -45447,7 +46962,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -45626,8 +47141,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -45638,7 +47153,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -45730,13 +47245,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -45893,7 +47411,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -45910,7 +47430,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -45928,12 +47451,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -45964,7 +47489,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -45975,11 +47501,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -46005,7 +47532,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -46088,7 +47620,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -46123,11 +47655,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -46164,7 +47697,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -46215,7 +47749,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -46230,7 +47771,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -46409,8 +47950,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -46421,7 +47962,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -46513,13 +48054,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -46676,7 +48220,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -46693,7 +48239,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -46711,12 +48260,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -46747,7 +48298,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -46758,11 +48310,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -46788,7 +48341,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -46871,7 +48429,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -46906,11 +48464,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -46947,7 +48506,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -46998,7 +48558,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -47013,7 +48580,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -47192,8 +48759,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -47204,7 +48771,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -47296,13 +48863,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -47459,7 +49029,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -47476,7 +49048,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -47494,12 +49069,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -47530,7 +49107,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -47541,11 +49119,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -47571,7 +49150,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -47654,7 +49238,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -47689,11 +49273,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -47730,7 +49315,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -47781,7 +49367,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -47796,7 +49389,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -47975,8 +49568,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -47987,7 +49580,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -48079,13 +49672,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -48242,7 +49838,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -48259,7 +49857,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -48277,12 +49878,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -48313,7 +49916,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -48324,11 +49928,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -48354,7 +49959,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -48437,7 +50047,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -48472,11 +50082,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -48513,7 +50124,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -48564,7 +50176,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -48579,7 +50198,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -48758,8 +50377,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -48770,7 +50389,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -48862,13 +50481,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -49025,7 +50647,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -49042,7 +50666,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -49060,12 +50687,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -49096,7 +50725,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -49107,11 +50737,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -49137,7 +50768,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -49220,7 +50856,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -49255,11 +50891,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -49296,7 +50933,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -49347,7 +50985,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -49362,7 +51007,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -49541,8 +51186,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -49553,7 +51198,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -49645,13 +51290,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -49808,7 +51456,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -49825,7 +51475,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -49843,12 +51496,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -49879,7 +51534,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -49890,11 +51546,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -49920,7 +51577,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -50003,7 +51665,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -50038,11 +51700,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -50079,7 +51742,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -50130,7 +51794,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -50145,7 +51816,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -50324,8 +51995,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -50336,7 +52007,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -50428,13 +52099,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -50591,7 +52265,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -50608,7 +52284,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -50626,12 +52305,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -50662,7 +52343,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -50673,11 +52355,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -50703,7 +52386,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -50786,7 +52474,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -50821,11 +52509,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -50862,7 +52551,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -50913,7 +52603,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -50928,7 +52625,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -51107,8 +52804,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -51119,7 +52816,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -51211,13 +52908,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -51374,7 +53074,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -51391,7 +53093,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -51409,12 +53114,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -51445,7 +53152,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -51456,11 +53164,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -51486,7 +53195,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -51569,7 +53283,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -51604,11 +53318,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -51645,7 +53360,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -51696,7 +53412,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -51711,7 +53434,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -51890,8 +53613,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -51902,7 +53625,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -51994,13 +53717,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -52157,7 +53883,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -52174,7 +53902,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -52192,12 +53923,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -52228,7 +53961,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -52239,11 +53973,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -52269,7 +54004,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -52352,7 +54092,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -52387,11 +54127,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -52428,7 +54169,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -52479,7 +54221,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -52494,7 +54243,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -52673,8 +54422,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -52685,7 +54434,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -52777,13 +54526,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -52940,7 +54692,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -52957,7 +54711,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -52975,12 +54732,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -53011,7 +54770,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -53022,11 +54782,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -53052,7 +54813,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -53135,7 +54901,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -53170,11 +54936,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -53211,7 +54978,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -53262,7 +55030,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -53277,7 +55052,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -53456,8 +55231,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -53468,7 +55243,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -53560,13 +55335,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -53723,7 +55501,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -53740,7 +55520,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -53758,12 +55541,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -53794,7 +55579,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -53805,11 +55591,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -53835,7 +55622,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -53918,7 +55710,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -53953,11 +55745,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -53994,7 +55787,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -54045,7 +55839,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -54060,7 +55861,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -54239,8 +56040,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -54251,7 +56052,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -54343,13 +56144,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -54506,7 +56310,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -54523,7 +56329,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -54541,12 +56350,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -54577,7 +56388,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -54588,11 +56400,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -54618,7 +56431,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -54701,7 +56519,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -54736,11 +56554,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -54777,7 +56596,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -54828,7 +56648,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -54843,7 +56670,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -55022,8 +56849,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -55034,7 +56861,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -55126,13 +56953,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -55289,7 +57119,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -55306,7 +57138,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -55324,12 +57159,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -55360,7 +57197,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -55371,11 +57209,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -55401,7 +57240,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -55484,7 +57328,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -55519,11 +57363,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -55560,7 +57405,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -55611,7 +57457,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -55626,7 +57479,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -55805,8 +57658,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -55817,7 +57670,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -55909,13 +57762,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -56072,7 +57928,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -56089,7 +57947,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -56107,12 +57968,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -56143,7 +58006,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -56154,11 +58018,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -56184,7 +58049,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -56267,7 +58137,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -56302,11 +58172,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -56343,7 +58214,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -56394,7 +58266,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -56409,7 +58288,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -56588,8 +58467,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -56600,7 +58479,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -56692,13 +58571,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -56855,7 +58737,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -56872,7 +58756,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -56890,12 +58777,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -56926,7 +58815,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -56937,11 +58827,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -56967,7 +58858,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -57050,7 +58946,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -57085,11 +58981,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -57126,7 +59023,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -57177,7 +59075,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -57192,7 +59097,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -57371,8 +59276,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -57383,7 +59288,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -57475,13 +59380,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -57638,7 +59546,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -57655,7 +59565,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -57673,12 +59586,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -57709,7 +59624,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -57720,11 +59636,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -57750,7 +59667,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -57833,7 +59755,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -57868,11 +59790,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -57909,7 +59832,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -57960,7 +59884,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -57975,7 +59906,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -58154,8 +60085,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -58166,7 +60097,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -58258,13 +60189,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -58421,7 +60355,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -58438,7 +60374,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -58456,12 +60395,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -58492,7 +60433,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -58503,11 +60445,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -58533,7 +60476,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -58616,7 +60564,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -58651,11 +60599,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -58692,7 +60641,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -58743,7 +60693,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -58758,7 +60715,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -58937,8 +60894,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -58949,7 +60906,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -59041,13 +60998,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -59204,7 +61164,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -59221,7 +61183,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -59239,12 +61204,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -59275,7 +61242,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -59286,11 +61254,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -59316,7 +61285,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -59399,7 +61373,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -59434,11 +61408,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -59475,7 +61450,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -59526,7 +61502,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -59541,7 +61524,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -59720,8 +61703,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -59732,7 +61715,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -59824,13 +61807,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -59987,7 +61973,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -60004,7 +61992,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -60022,12 +62013,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -60058,7 +62051,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -60069,11 +62063,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -60099,7 +62094,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -60182,7 +62182,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -60217,11 +62217,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -60258,7 +62259,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -60309,7 +62311,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -60324,7 +62333,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -60503,8 +62512,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -60515,7 +62524,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -60607,13 +62616,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -60770,7 +62782,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -60787,7 +62801,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -60805,12 +62822,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -60841,7 +62860,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -60852,11 +62872,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -60882,7 +62903,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -60965,7 +62991,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -61000,11 +63026,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -61041,7 +63068,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -61092,7 +63120,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -61107,7 +63142,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -61286,8 +63321,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -61298,7 +63333,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -61390,13 +63425,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -61553,7 +63591,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -61570,7 +63610,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -61588,12 +63631,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -61624,7 +63669,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -61635,11 +63681,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -61665,7 +63712,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -61748,7 +63800,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -61783,11 +63835,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -61824,7 +63877,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -61875,7 +63929,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -61890,7 +63951,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -62069,8 +64130,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -62081,7 +64142,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -62173,13 +64234,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -62336,7 +64400,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -62353,7 +64419,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -62371,12 +64440,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -62407,7 +64478,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -62418,11 +64490,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -62448,7 +64521,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -62531,7 +64609,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -62566,11 +64644,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -62607,7 +64686,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -62658,7 +64738,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -62673,7 +64760,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -62852,8 +64939,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -62864,7 +64951,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -62956,13 +65043,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -63119,7 +65209,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -63136,7 +65228,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -63154,12 +65249,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -63190,7 +65287,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -63201,11 +65299,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -63231,7 +65330,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -63314,7 +65418,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -63349,11 +65453,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -63390,7 +65495,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -63441,7 +65547,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -63456,7 +65569,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -63635,8 +65748,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -63647,7 +65760,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -63739,13 +65852,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -63902,7 +66018,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -63919,7 +66037,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -63937,12 +66058,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -63973,7 +66096,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -63984,11 +66108,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -64014,7 +66139,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -64097,7 +66227,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -64132,11 +66262,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -64173,7 +66304,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -64224,7 +66356,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -64239,7 +66378,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -64418,8 +66557,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -64430,7 +66569,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -64522,13 +66661,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -64685,7 +66827,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -64702,7 +66846,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -64720,12 +66867,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -64756,7 +66905,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -64767,11 +66917,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -64797,7 +66948,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -64880,7 +67036,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -64915,11 +67071,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -64956,7 +67113,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -65007,7 +67165,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -65022,7 +67187,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -65201,8 +67366,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -65213,7 +67378,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -65305,13 +67470,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -65468,7 +67636,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -65485,7 +67655,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -65503,12 +67676,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -65539,7 +67714,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -65550,11 +67726,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -65580,7 +67757,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -65663,7 +67845,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -65698,11 +67880,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -65739,7 +67922,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -65790,7 +67974,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -65805,7 +67996,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -65984,8 +68175,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -65996,7 +68187,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -66088,13 +68279,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -66251,7 +68445,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -66268,7 +68464,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -66286,12 +68485,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -66322,7 +68523,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -66333,11 +68535,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -66363,7 +68566,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -66446,7 +68654,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -66481,11 +68689,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -66522,7 +68731,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -66573,7 +68783,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -66588,7 +68805,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -66767,8 +68984,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -66779,7 +68996,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -66871,13 +69088,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -67034,7 +69254,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -67051,7 +69273,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -67069,12 +69294,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -67105,7 +69332,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -67116,11 +69344,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -67146,7 +69375,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -67229,7 +69463,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -67264,11 +69498,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -67305,7 +69540,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -67356,7 +69592,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -67371,7 +69614,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -67550,8 +69793,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -67562,7 +69805,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -67654,13 +69897,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -67817,7 +70063,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -67834,7 +70082,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -67852,12 +70103,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -67888,7 +70141,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -67899,11 +70153,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -67929,7 +70184,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -68012,7 +70272,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -68047,11 +70307,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -68088,7 +70349,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -68139,7 +70401,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -68154,7 +70423,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -68333,8 +70602,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -68345,7 +70614,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -68437,13 +70706,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -68600,7 +70872,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -68617,7 +70891,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -68635,12 +70912,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -68671,7 +70950,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -68682,11 +70962,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -68712,7 +70993,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -68795,7 +71081,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -68830,11 +71116,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -68871,7 +71158,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -68922,7 +71210,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -68937,7 +71232,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -69116,8 +71411,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -69128,7 +71423,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -69220,13 +71515,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -69383,7 +71681,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -69400,7 +71700,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -69418,12 +71721,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -69454,7 +71759,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -69465,11 +71771,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -69495,7 +71802,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -69578,7 +71890,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -69613,11 +71925,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -69654,7 +71967,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -69705,7 +72019,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -69720,7 +72041,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -69899,8 +72220,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -69911,7 +72232,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -70003,13 +72324,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -70166,7 +72490,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -70183,7 +72509,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -70201,12 +72530,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -70237,7 +72568,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -70248,11 +72580,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -70278,7 +72611,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -70361,7 +72699,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -70396,11 +72734,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -70437,7 +72776,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -70488,7 +72828,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -70503,7 +72850,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -70682,8 +73029,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -70694,7 +73041,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -70786,13 +73133,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -70949,7 +73299,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -70966,7 +73318,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -70984,12 +73339,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -71020,7 +73377,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -71031,11 +73389,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -71061,7 +73420,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -71144,7 +73508,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -71179,11 +73543,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -71220,7 +73585,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -71271,7 +73637,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -71286,7 +73659,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -71465,8 +73838,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -71477,7 +73850,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -71569,13 +73942,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -71732,7 +74108,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -71749,7 +74127,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -71767,12 +74148,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -71803,7 +74186,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -71814,11 +74198,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -71844,7 +74229,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -71927,7 +74317,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -71962,11 +74352,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -72003,7 +74394,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -72054,7 +74446,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -72069,7 +74468,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -72248,8 +74647,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -72260,7 +74659,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -72352,13 +74751,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -72515,7 +74917,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -72532,7 +74936,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -72550,12 +74957,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -72586,7 +74995,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -72597,11 +75007,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -72627,7 +75038,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -72710,7 +75126,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -72745,11 +75161,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -72786,7 +75203,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -72837,7 +75255,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -72852,7 +75277,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -73031,8 +75456,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -73043,7 +75468,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -73135,13 +75560,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -73298,7 +75726,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -73315,7 +75745,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -73333,12 +75766,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -73369,7 +75804,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -73380,11 +75816,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -73410,7 +75847,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -73493,7 +75935,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -73528,11 +75970,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -73569,7 +76012,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -73620,7 +76064,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -73635,7 +76086,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -73814,8 +76265,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -73826,7 +76277,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -73918,13 +76369,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -74081,7 +76535,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -74098,7 +76554,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -74116,12 +76575,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -74152,7 +76613,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -74163,11 +76625,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -74193,7 +76656,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -74276,7 +76744,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -74311,11 +76779,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -74352,7 +76821,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -74403,7 +76873,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -74418,7 +76895,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -74597,8 +77074,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -74609,7 +77086,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -74701,13 +77178,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -74864,7 +77344,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -74881,7 +77363,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -74899,12 +77384,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -74935,7 +77422,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -74946,11 +77434,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -74976,7 +77465,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -75059,7 +77553,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -75094,11 +77588,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -75135,7 +77630,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -75186,7 +77682,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -75201,7 +77704,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -75380,8 +77883,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -75392,7 +77895,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -75484,13 +77987,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -75647,7 +78153,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -75664,7 +78172,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -75682,12 +78193,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -75718,7 +78231,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -75729,11 +78243,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -75759,7 +78274,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -75842,7 +78362,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -75877,11 +78397,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -75918,7 +78439,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -75969,7 +78491,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -75984,7 +78513,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -76163,8 +78692,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -76175,7 +78704,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -76267,13 +78796,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -76430,7 +78962,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -76447,7 +78981,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -76465,12 +79002,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -76501,7 +79040,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -76512,11 +79052,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -76542,7 +79083,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -76625,7 +79171,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -76660,11 +79206,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -76701,7 +79248,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -76752,7 +79300,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -76767,7 +79322,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -76946,8 +79501,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -76958,7 +79513,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -77050,13 +79605,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -77213,7 +79771,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -77230,7 +79790,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -77248,12 +79811,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -77284,7 +79849,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -77295,11 +79861,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -77325,7 +79892,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -77408,7 +79980,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -77443,11 +80015,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -77484,7 +80057,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -77535,7 +80109,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -77550,7 +80131,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -77729,8 +80310,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -77741,7 +80322,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -77833,13 +80414,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -77996,7 +80580,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -78013,7 +80599,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -78031,12 +80620,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -78067,7 +80658,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -78078,11 +80670,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -78108,7 +80701,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -78191,7 +80789,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -78226,11 +80824,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -78267,7 +80866,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -78318,7 +80918,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -78333,7 +80940,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -78512,8 +81119,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -78524,7 +81131,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -78616,13 +81223,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -78779,7 +81389,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -78796,7 +81408,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -78814,12 +81429,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -78850,7 +81467,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -78861,11 +81479,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -78891,7 +81510,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -78974,7 +81598,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -79009,11 +81633,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -79050,7 +81675,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -79101,7 +81727,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -79116,7 +81749,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -79295,8 +81928,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -79307,7 +81940,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -79399,13 +82032,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -79562,7 +82198,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -79579,7 +82217,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -79597,12 +82238,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -79633,7 +82276,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -79644,11 +82288,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -79674,7 +82319,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -79757,7 +82407,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -79792,11 +82442,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -79833,7 +82484,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -79884,7 +82536,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -79899,7 +82558,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -80078,8 +82737,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -80090,7 +82749,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -80182,13 +82841,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -80345,7 +83007,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -80362,7 +83026,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -80380,12 +83047,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -80416,7 +83085,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -80427,11 +83097,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -80457,7 +83128,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -80540,7 +83216,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -80575,11 +83251,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -80616,7 +83293,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -80667,7 +83345,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -80682,7 +83367,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -80861,8 +83546,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -80873,7 +83558,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -80965,13 +83650,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -81128,7 +83816,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -81145,7 +83835,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -81163,12 +83856,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -81199,7 +83894,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -81210,11 +83906,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -81240,7 +83937,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -81323,7 +84025,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -81358,11 +84060,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -81399,7 +84102,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -81450,7 +84154,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -81465,7 +84176,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -81644,8 +84355,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -81656,7 +84367,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -81748,13 +84459,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -81911,7 +84625,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -81928,7 +84644,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -81946,12 +84665,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -81982,7 +84703,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -81993,11 +84715,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -82023,7 +84746,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -82106,7 +84834,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -82141,11 +84869,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -82182,7 +84911,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -82233,7 +84963,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -82248,7 +84985,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -82427,8 +85164,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -82439,7 +85176,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -82531,13 +85268,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -82694,7 +85434,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -82711,7 +85453,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -82729,12 +85474,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -82765,7 +85512,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -82776,11 +85524,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -82806,7 +85555,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -82889,7 +85643,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -82924,11 +85678,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -82965,7 +85720,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -83016,7 +85772,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -83031,7 +85794,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -83210,8 +85973,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -83222,7 +85985,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -83314,13 +86077,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -83477,7 +86243,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -83494,7 +86262,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -83512,12 +86283,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -83548,7 +86321,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -83559,11 +86333,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -83589,7 +86364,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -83672,7 +86452,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -83707,11 +86487,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -83748,7 +86529,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -83799,7 +86581,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -83814,7 +86603,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -83993,8 +86782,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -84005,7 +86794,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -84097,13 +86886,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -84260,7 +87052,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -84277,7 +87071,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -84295,12 +87092,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -84331,7 +87130,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -84342,11 +87142,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -84372,7 +87173,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -84455,7 +87261,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -84490,11 +87296,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -84531,7 +87338,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -84582,7 +87390,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -84597,7 +87412,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -84776,8 +87591,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -84788,7 +87603,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -84880,13 +87695,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -85043,7 +87861,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -85060,7 +87880,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -85078,12 +87901,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -85114,7 +87939,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -85125,11 +87951,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -85155,7 +87982,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -85238,7 +88070,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -85273,11 +88105,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -85314,7 +88147,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -85365,7 +88199,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -85380,7 +88221,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -85559,8 +88400,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -85571,7 +88412,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -85663,13 +88504,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -85826,7 +88670,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -85843,7 +88689,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -85861,12 +88710,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -85897,7 +88748,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -85908,11 +88760,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -85938,7 +88791,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -86021,7 +88879,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -86056,11 +88914,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -86097,7 +88956,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -86148,7 +89008,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -86163,7 +89030,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -86342,8 +89209,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -86354,7 +89221,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -86446,13 +89313,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -86609,7 +89479,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -86626,7 +89498,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -86644,12 +89519,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -86680,7 +89557,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -86691,11 +89569,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -86721,7 +89600,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -86804,7 +89688,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -86839,11 +89723,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -86880,7 +89765,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -86931,7 +89817,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -86946,7 +89839,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -87125,8 +90018,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -87137,7 +90030,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -87229,13 +90122,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -87392,7 +90288,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -87409,7 +90307,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -87427,12 +90328,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -87463,7 +90366,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -87474,11 +90378,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -87504,7 +90409,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -87587,7 +90497,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -87622,11 +90532,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -87663,7 +90574,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -87714,7 +90626,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -87729,7 +90648,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -87908,8 +90827,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -87920,7 +90839,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -88012,13 +90931,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -88175,7 +91097,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -88192,7 +91116,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -88210,12 +91137,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -88246,7 +91175,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -88257,11 +91187,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -88287,7 +91218,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -88370,7 +91306,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -88405,11 +91341,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -88446,7 +91383,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -88497,7 +91435,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -88512,7 +91457,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -88691,8 +91636,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -88703,7 +91648,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -88795,13 +91740,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -88958,7 +91906,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -88975,7 +91925,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -88993,12 +91946,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -89029,7 +91984,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -89040,11 +91996,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -89070,7 +92027,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -89153,7 +92115,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -89188,11 +92150,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -89229,7 +92192,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -89280,7 +92244,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -89295,7 +92266,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -89474,8 +92445,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -89486,7 +92457,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -89578,13 +92549,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -89741,7 +92715,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -89758,7 +92734,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -89776,12 +92755,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -89812,7 +92793,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -89823,11 +92805,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -89853,7 +92836,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -89936,7 +92924,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -89971,11 +92959,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -90012,7 +93001,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -90063,7 +93053,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -90078,7 +93075,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -90257,8 +93254,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -90269,7 +93266,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -90361,13 +93358,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -90524,7 +93524,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -90541,7 +93543,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -90559,12 +93564,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -90595,7 +93602,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -90606,11 +93614,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -90636,7 +93645,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -90719,7 +93733,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -90754,11 +93768,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -90795,7 +93810,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -90846,7 +93862,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -90861,7 +93884,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -91040,8 +94063,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -91052,7 +94075,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -91144,13 +94167,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -91307,7 +94333,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -91324,7 +94352,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -91342,12 +94373,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -91378,7 +94411,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -91389,11 +94423,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -91419,7 +94454,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -91502,7 +94542,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -91537,11 +94577,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -91578,7 +94619,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -91629,7 +94671,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -91644,7 +94693,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -91823,8 +94872,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -91835,7 +94884,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -91927,13 +94976,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -92090,7 +95142,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -92107,7 +95161,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -92125,12 +95182,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -92161,7 +95220,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -92172,11 +95232,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -92202,7 +95263,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -92285,7 +95351,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -92320,11 +95386,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -92361,7 +95428,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -92412,7 +95480,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -92427,7 +95502,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -92606,8 +95681,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -92618,7 +95693,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -92710,13 +95785,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -92873,7 +95951,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -92890,7 +95970,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -92908,12 +95991,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -92944,7 +96029,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -92955,11 +96041,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -92985,7 +96072,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -93068,7 +96160,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -93103,11 +96195,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -93144,7 +96237,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -93195,7 +96289,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -93210,7 +96311,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -93389,8 +96490,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -93401,7 +96502,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -93493,13 +96594,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -93656,7 +96760,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -93673,7 +96779,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -93691,12 +96800,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -93727,7 +96838,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -93738,11 +96850,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -93768,7 +96881,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -93851,7 +96969,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -93886,11 +97004,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -93927,7 +97046,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -93978,7 +97098,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -93993,7 +97120,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -94172,8 +97299,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -94184,7 +97311,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -94276,13 +97403,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -94439,7 +97569,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -94456,7 +97588,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -94474,12 +97609,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -94510,7 +97647,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -94521,11 +97659,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -94551,7 +97690,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -94634,7 +97778,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -94669,11 +97813,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -94710,7 +97855,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -94761,7 +97907,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -94776,7 +97929,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -94955,8 +98108,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -94967,7 +98120,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -95059,13 +98212,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -95222,7 +98378,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -95239,7 +98397,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -95257,12 +98418,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -95293,7 +98456,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -95304,11 +98468,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -95334,7 +98499,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -95417,7 +98587,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -95452,11 +98622,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -95493,7 +98664,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -95544,7 +98716,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -95559,7 +98738,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -95738,8 +98917,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -95750,7 +98929,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -95842,13 +99021,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -96005,7 +99187,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -96022,7 +99206,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -96040,12 +99227,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -96076,7 +99265,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -96087,11 +99277,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -96117,7 +99308,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -96200,7 +99396,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -96235,11 +99431,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -96276,7 +99473,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -96327,7 +99525,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -96342,7 +99547,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -96521,8 +99726,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -96533,7 +99738,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -96625,13 +99830,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -96788,7 +99996,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -96805,7 +100015,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -96823,12 +100036,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -96859,7 +100074,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -96870,11 +100086,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -96900,7 +100117,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -96983,7 +100205,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -97018,11 +100240,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -97059,7 +100282,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -97110,7 +100334,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -97125,7 +100356,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -97304,8 +100535,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -97316,7 +100547,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -97408,13 +100639,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -97571,7 +100805,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -97588,7 +100824,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -97606,12 +100845,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -97642,7 +100883,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -97653,11 +100895,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -97683,7 +100926,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -97766,7 +101014,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -97801,11 +101049,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -97842,7 +101091,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -97893,7 +101143,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -97908,7 +101165,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -98087,8 +101344,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -98099,7 +101356,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -98191,13 +101448,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -98354,7 +101614,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -98371,7 +101633,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -98389,12 +101654,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -98425,7 +101692,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -98436,11 +101704,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -98466,7 +101735,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -98549,7 +101823,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -98584,11 +101858,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -98625,7 +101900,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -98676,7 +101952,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -98691,7 +101974,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -98870,8 +102153,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -98882,7 +102165,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -98974,13 +102257,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -99137,7 +102423,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -99154,7 +102442,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -99172,12 +102463,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -99208,7 +102501,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -99219,11 +102513,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -99249,7 +102544,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -99332,7 +102632,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -99367,11 +102667,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -99408,7 +102709,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -99459,7 +102761,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -99474,7 +102783,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -99653,8 +102962,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -99665,7 +102974,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -99757,13 +103066,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -99920,7 +103232,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -99937,7 +103251,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -99955,12 +103272,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -99991,7 +103310,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -100002,11 +103322,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -100032,7 +103353,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -100115,7 +103441,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -100150,11 +103476,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -100191,7 +103518,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -100242,7 +103570,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -100257,7 +103592,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -100436,8 +103771,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -100448,7 +103783,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -100540,13 +103875,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -100703,7 +104041,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -100720,7 +104060,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -100738,12 +104081,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -100774,7 +104119,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -100785,11 +104131,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -100815,7 +104162,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -100898,7 +104250,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -100933,11 +104285,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -100974,7 +104327,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -101025,7 +104379,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -101040,7 +104401,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -101219,8 +104580,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -101231,7 +104592,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -101323,13 +104684,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -101486,7 +104850,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -101503,7 +104869,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -101521,12 +104890,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -101557,7 +104928,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -101568,11 +104940,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -101598,7 +104971,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -101681,7 +105059,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -101716,11 +105094,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -101757,7 +105136,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -101808,7 +105188,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -101823,7 +105210,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -102002,8 +105389,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -102014,7 +105401,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -102106,13 +105493,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -102269,7 +105659,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -102286,7 +105678,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -102304,12 +105699,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -102340,7 +105737,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -102351,11 +105749,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -102381,7 +105780,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -102464,7 +105868,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -102499,11 +105903,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -102540,7 +105945,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -102591,7 +105997,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -102606,7 +106019,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -102785,8 +106198,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -102797,7 +106210,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -102889,13 +106302,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -103052,7 +106468,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -103069,7 +106487,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -103087,12 +106508,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -103123,7 +106546,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -103134,11 +106558,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -103164,7 +106589,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -103247,7 +106677,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -103282,11 +106712,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -103323,7 +106754,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -103374,7 +106806,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -103389,7 +106828,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -103568,8 +107007,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -103580,7 +107019,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -103672,13 +107111,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -103835,7 +107277,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -103852,7 +107296,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -103870,12 +107317,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -103906,7 +107355,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -103917,11 +107367,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -103947,7 +107398,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -104030,7 +107486,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -104065,11 +107521,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -104106,7 +107563,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -104157,7 +107615,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -104172,7 +107637,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -104351,8 +107816,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -104363,7 +107828,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -104455,13 +107920,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -104618,7 +108086,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -104635,7 +108105,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -104653,12 +108126,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -104689,7 +108164,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -104700,11 +108176,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -104730,7 +108207,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -104813,7 +108295,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -104848,11 +108330,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -104889,7 +108372,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -104940,7 +108424,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -104955,7 +108446,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -105134,8 +108625,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -105146,7 +108637,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -105238,13 +108729,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -105401,7 +108895,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -105418,7 +108914,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -105436,12 +108935,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -105472,7 +108973,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -105483,11 +108985,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -105513,7 +109016,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -105596,7 +109104,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -105631,11 +109139,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -105672,7 +109181,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -105723,7 +109233,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -105738,7 +109255,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -105917,8 +109434,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -105929,7 +109446,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -106021,13 +109538,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -106184,7 +109704,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -106201,7 +109723,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -106219,12 +109744,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -106255,7 +109782,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -106266,11 +109794,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -106296,7 +109825,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -106379,7 +109913,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -106414,11 +109948,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -106455,7 +109990,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -106506,7 +110042,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -106521,7 +110064,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -106700,8 +110243,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -106712,7 +110255,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -106804,13 +110347,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -106967,7 +110513,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -106984,7 +110532,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -107002,12 +110553,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -107038,7 +110591,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -107049,11 +110603,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -107079,7 +110634,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -107162,7 +110722,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -107197,11 +110757,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -107238,7 +110799,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -107289,7 +110851,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -107304,7 +110873,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -107483,8 +111052,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -107495,7 +111064,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -107587,13 +111156,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -107750,7 +111322,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -107767,7 +111341,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -107785,12 +111362,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -107821,7 +111400,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -107832,11 +111412,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -107862,7 +111443,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -107945,7 +111531,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -107980,11 +111566,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -108021,7 +111608,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -108072,7 +111660,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -108087,7 +111682,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -108266,8 +111861,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -108278,7 +111873,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -108370,13 +111965,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -108533,7 +112131,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -108550,7 +112150,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -108568,12 +112171,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -108604,7 +112209,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -108615,11 +112221,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -108645,7 +112252,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -108728,7 +112340,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -108763,11 +112375,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -108804,7 +112417,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -108855,7 +112469,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -108870,7 +112491,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -109049,8 +112670,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -109061,7 +112682,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -109153,13 +112774,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -109316,7 +112940,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -109333,7 +112959,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -109351,12 +112980,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -109387,7 +113018,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -109398,11 +113030,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -109428,7 +113061,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -109511,7 +113149,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -109546,11 +113184,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -109587,7 +113226,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -109638,7 +113278,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -109653,7 +113300,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -109832,8 +113479,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -109844,7 +113491,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -109936,13 +113583,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -110099,7 +113749,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -110116,7 +113768,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -110134,12 +113789,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -110170,7 +113827,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -110181,11 +113839,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -110211,7 +113870,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -110294,7 +113958,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -110329,11 +113993,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -110370,7 +114035,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -110421,7 +114087,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -110436,7 +114109,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -110615,8 +114288,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -110627,7 +114300,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -110719,13 +114392,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -110882,7 +114558,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -110899,7 +114577,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -110917,12 +114598,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -110953,7 +114636,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -110964,11 +114648,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -110994,7 +114679,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -111077,7 +114767,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -111112,11 +114802,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -111153,7 +114844,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -111204,7 +114896,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -111219,7 +114918,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -111398,8 +115097,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -111410,7 +115109,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -111502,13 +115201,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -111665,7 +115367,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -111682,7 +115386,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -111700,12 +115407,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -111736,7 +115445,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -111747,11 +115457,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -111777,7 +115488,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -111860,7 +115576,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -111895,11 +115611,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -111936,7 +115653,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -111987,7 +115705,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -112002,7 +115727,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -112181,8 +115906,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -112193,7 +115918,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -112285,13 +116010,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -112448,7 +116176,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -112465,7 +116195,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -112483,12 +116216,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -112519,7 +116254,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -112530,11 +116266,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -112560,7 +116297,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -112643,7 +116385,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -112678,11 +116420,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -112719,7 +116462,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -112770,7 +116514,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -112785,7 +116536,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -112964,8 +116715,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -112976,7 +116727,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -113068,13 +116819,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -113231,7 +116985,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -113248,7 +117004,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -113266,12 +117025,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -113302,7 +117063,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -113313,11 +117075,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -113343,7 +117106,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -113426,7 +117194,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -113461,11 +117229,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -113502,7 +117271,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -113553,7 +117323,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -113568,7 +117345,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -113747,8 +117524,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -113759,7 +117536,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -113851,13 +117628,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -114014,7 +117794,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -114031,7 +117813,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -114049,12 +117834,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -114085,7 +117872,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -114096,11 +117884,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -114126,7 +117915,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -114209,7 +118003,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -114244,11 +118038,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -114285,7 +118080,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -114336,7 +118132,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -114351,7 +118154,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -114530,8 +118333,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -114542,7 +118345,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -114634,13 +118437,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -114797,7 +118603,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -114814,7 +118622,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -114832,12 +118643,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -114868,7 +118681,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -114879,11 +118693,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -114909,7 +118724,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -114992,7 +118812,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -115027,11 +118847,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -115068,7 +118889,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -115119,7 +118941,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -115134,7 +118963,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -115313,8 +119142,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -115325,7 +119154,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -115417,13 +119246,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -115580,7 +119412,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -115597,7 +119431,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -115615,12 +119452,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -115651,7 +119490,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -115662,11 +119502,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -115692,7 +119533,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -115775,7 +119621,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -115810,11 +119656,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -115851,7 +119698,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -115902,7 +119750,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -115917,7 +119772,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -116096,8 +119951,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -116108,7 +119963,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -116200,13 +120055,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -116363,7 +120221,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -116380,7 +120240,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -116398,12 +120261,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -116434,7 +120299,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -116445,11 +120311,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -116475,7 +120342,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -116558,7 +120430,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -116593,11 +120465,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -116634,7 +120507,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -116685,7 +120559,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -116700,7 +120581,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -116879,8 +120760,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -116891,7 +120772,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -116983,13 +120864,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -117146,7 +121030,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -117163,7 +121049,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -117181,12 +121070,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -117217,7 +121108,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -117228,11 +121120,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -117258,7 +121151,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -117341,7 +121239,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -117376,11 +121274,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -117417,7 +121316,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -117468,7 +121368,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -117483,7 +121390,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -117662,8 +121569,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -117674,7 +121581,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -117766,13 +121673,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -117929,7 +121839,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -117946,7 +121858,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -117964,12 +121879,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -118000,7 +121917,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -118011,11 +121929,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -118041,7 +121960,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -118124,7 +122048,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -118159,11 +122083,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -118200,7 +122125,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -118251,7 +122177,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -118266,7 +122199,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -118445,8 +122378,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -118457,7 +122390,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -118549,13 +122482,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -118712,7 +122648,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -118729,7 +122667,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -118747,12 +122688,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -118783,7 +122726,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -118794,11 +122738,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -118824,7 +122769,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -118907,7 +122857,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -118942,11 +122892,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -118983,7 +122934,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -119034,7 +122986,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -119049,7 +123008,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -119228,8 +123187,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -119240,7 +123199,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -119332,13 +123291,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -119495,7 +123457,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -119512,7 +123476,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -119530,12 +123497,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -119566,7 +123535,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -119577,11 +123547,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -119607,7 +123578,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -119690,7 +123666,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -119725,11 +123701,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -119766,7 +123743,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -119817,7 +123795,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -119832,7 +123817,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -120011,8 +123996,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -120023,7 +124008,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -120115,13 +124100,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -120278,7 +124266,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -120295,7 +124285,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -120313,12 +124306,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -120349,7 +124344,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -120360,11 +124356,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -120390,7 +124387,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -120473,7 +124475,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -120508,11 +124510,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -120549,7 +124552,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -120600,7 +124604,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -120615,7 +124626,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -120794,8 +124805,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -120806,7 +124817,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -120898,13 +124909,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -121061,7 +125075,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -121078,7 +125094,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -121096,12 +125115,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -121132,7 +125153,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -121143,11 +125165,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -121173,7 +125196,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -121256,7 +125284,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -121291,11 +125319,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -121332,7 +125361,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -121383,7 +125413,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -121398,7 +125435,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -121577,8 +125614,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -121589,7 +125626,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -121681,13 +125718,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -121844,7 +125884,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -121861,7 +125903,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -121879,12 +125924,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -121915,7 +125962,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -121926,11 +125974,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -121956,7 +126005,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -122039,7 +126093,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -122074,11 +126128,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -122115,7 +126170,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -122166,7 +126222,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -122181,7 +126244,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -122360,8 +126423,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -122372,7 +126435,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -122464,13 +126527,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -122627,7 +126693,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -122644,7 +126712,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -122662,12 +126733,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -122698,7 +126771,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -122709,11 +126783,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -122739,7 +126814,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -122822,7 +126902,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -122857,11 +126937,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -122898,7 +126979,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -122949,7 +127031,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -122964,7 +127053,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -123143,8 +127232,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -123155,7 +127244,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -123247,13 +127336,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -123410,7 +127502,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -123427,7 +127521,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -123445,12 +127542,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -123481,7 +127580,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -123492,11 +127592,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -123522,7 +127623,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -123605,7 +127711,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -123640,11 +127746,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -123681,7 +127788,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -123732,7 +127840,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -123747,7 +127862,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -123926,8 +128041,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -123938,7 +128053,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -124030,13 +128145,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -124193,7 +128311,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -124210,7 +128330,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -124228,12 +128351,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -124264,7 +128389,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -124275,11 +128401,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -124305,7 +128432,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -124388,7 +128520,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -124423,11 +128555,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -124464,7 +128597,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -124515,7 +128649,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -124530,7 +128671,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -124709,8 +128850,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -124721,7 +128862,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -124813,13 +128954,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -124976,7 +129120,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -124993,7 +129139,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -125011,12 +129160,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -125047,7 +129198,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -125058,11 +129210,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -125088,7 +129241,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -125171,7 +129329,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -125206,11 +129364,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -125247,7 +129406,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -125298,7 +129458,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -125313,7 +129480,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -125492,8 +129659,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -125504,7 +129671,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -125596,13 +129763,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -125759,7 +129929,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -125776,7 +129948,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -125794,12 +129969,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -125830,7 +130007,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -125841,11 +130019,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -125871,7 +130050,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -125954,7 +130138,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -125989,11 +130173,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -126030,7 +130215,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -126081,7 +130267,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -126096,7 +130289,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -126275,8 +130468,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -126287,7 +130480,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -126379,13 +130572,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -126542,7 +130738,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -126559,7 +130757,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -126577,12 +130778,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -126613,7 +130816,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -126624,11 +130828,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -126654,7 +130859,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -126737,7 +130947,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -126772,11 +130982,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -126813,7 +131024,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -126864,7 +131076,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -126879,7 +131098,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -127058,8 +131277,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -127070,7 +131289,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -127162,13 +131381,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -127325,7 +131547,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -127342,7 +131566,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -127360,12 +131587,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -127396,7 +131625,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -127407,11 +131637,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -127437,7 +131668,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -127520,7 +131756,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -127555,11 +131791,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -127596,7 +131833,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -127647,7 +131885,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -127662,7 +131907,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -127841,8 +132086,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -127853,7 +132098,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -127945,13 +132190,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -128108,7 +132356,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -128125,7 +132375,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -128143,12 +132396,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -128179,7 +132434,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -128190,11 +132446,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -128220,7 +132477,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -128303,7 +132565,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -128338,11 +132600,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -128379,7 +132642,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -128430,7 +132694,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -128445,7 +132716,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -128624,8 +132895,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -128636,7 +132907,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -128728,13 +132999,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -128891,7 +133165,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -128908,7 +133184,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -128926,12 +133205,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -128962,7 +133243,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -128973,11 +133255,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -129003,7 +133286,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -129086,7 +133374,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -129121,11 +133409,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -129162,7 +133451,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -129213,7 +133503,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -129228,7 +133525,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -129407,8 +133704,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -129419,7 +133716,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -129511,13 +133808,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -129674,7 +133974,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -129691,7 +133993,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -129709,12 +134014,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -129745,7 +134052,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -129756,11 +134064,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -129786,7 +134095,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -129869,7 +134183,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -129904,11 +134218,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -129945,7 +134260,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -129996,7 +134312,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -130011,7 +134334,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -130190,8 +134513,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -130202,7 +134525,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -130294,13 +134617,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -130457,7 +134783,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -130474,7 +134802,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -130492,12 +134823,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -130528,7 +134861,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -130539,11 +134873,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -130569,7 +134904,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -130652,7 +134992,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -130687,11 +135027,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -130728,7 +135069,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -130779,7 +135121,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -130794,7 +135143,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -130973,8 +135322,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -130985,7 +135334,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -131077,13 +135426,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -131240,7 +135592,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -131257,7 +135611,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -131275,12 +135632,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -131311,7 +135670,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -131322,11 +135682,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -131352,7 +135713,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -131435,7 +135801,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -131470,11 +135836,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -131511,7 +135878,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -131562,7 +135930,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -131577,7 +135952,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -131756,8 +136131,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -131768,7 +136143,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -131860,13 +136235,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -132023,7 +136401,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -132040,7 +136420,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -132058,12 +136441,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -132094,7 +136479,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -132105,11 +136491,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -132135,7 +136522,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -132218,7 +136610,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -132253,11 +136645,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -132294,7 +136687,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -132345,7 +136739,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -132360,7 +136761,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -132539,8 +136940,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -132551,7 +136952,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -132643,13 +137044,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -132806,7 +137210,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -132823,7 +137229,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -132841,12 +137250,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -132877,7 +137288,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -132888,11 +137300,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -132918,7 +137331,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -133001,7 +137419,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -133036,11 +137454,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -133077,7 +137496,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -133128,7 +137548,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -133143,7 +137570,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -133322,8 +137749,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -133334,7 +137761,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -133426,13 +137853,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -133589,7 +138019,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -133606,7 +138038,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -133624,12 +138059,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -133660,7 +138097,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -133671,11 +138109,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -133701,7 +138140,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -133784,7 +138228,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -133819,11 +138263,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -133860,7 +138305,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -133911,7 +138357,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -133926,7 +138379,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -134105,8 +138558,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -134117,7 +138570,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -134209,13 +138662,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -134372,7 +138828,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -134389,7 +138847,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -134407,12 +138868,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -134443,7 +138906,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -134454,11 +138918,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -134484,7 +138949,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -134567,7 +139037,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -134602,11 +139072,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -134643,7 +139114,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -134694,7 +139166,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -134709,7 +139188,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -134888,8 +139367,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -134900,7 +139379,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -134992,13 +139471,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -135155,7 +139637,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -135172,7 +139656,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -135190,12 +139677,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -135226,7 +139715,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -135237,11 +139727,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -135267,7 +139758,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -135350,7 +139846,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -135385,11 +139881,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -135426,7 +139923,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -135477,7 +139975,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -135492,7 +139997,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -135671,8 +140176,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -135683,7 +140188,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -135775,13 +140280,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -135938,7 +140446,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -135955,7 +140465,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -135973,12 +140486,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -136009,7 +140524,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -136020,11 +140536,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -136050,7 +140567,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -136133,7 +140655,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -136168,11 +140690,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -136209,7 +140732,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -136260,7 +140784,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -136275,7 +140806,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -136454,8 +140985,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -136466,7 +140997,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -136558,13 +141089,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -136721,7 +141255,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -136738,7 +141274,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -136756,12 +141295,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -136792,7 +141333,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -136803,11 +141345,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -136833,7 +141376,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -136916,7 +141464,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -136951,11 +141499,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -136992,7 +141541,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -137043,7 +141593,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -137058,7 +141615,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -137237,8 +141794,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -137249,7 +141806,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -137341,13 +141898,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -137504,7 +142064,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -137521,7 +142083,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -137539,12 +142104,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -137575,7 +142142,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -137586,11 +142154,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -137616,7 +142185,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -137699,7 +142273,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -137734,11 +142308,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -137775,7 +142350,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -137826,7 +142402,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -137841,7 +142424,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -138020,8 +142603,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -138032,7 +142615,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -138124,13 +142707,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -138287,7 +142873,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -138304,7 +142892,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -138322,12 +142913,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -138358,7 +142951,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -138369,11 +142963,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -138399,7 +142994,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -138482,7 +143082,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -138517,11 +143117,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -138558,7 +143159,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -138609,7 +143211,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -138624,7 +143233,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -138803,8 +143412,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -138815,7 +143424,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -138907,13 +143516,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -139070,7 +143682,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -139087,7 +143701,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -139105,12 +143722,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -139141,7 +143760,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -139152,11 +143772,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -139182,7 +143803,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -139265,7 +143891,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -139300,11 +143926,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -139341,7 +143968,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -139392,7 +144020,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -139407,7 +144042,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -139586,8 +144221,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -139598,7 +144233,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -139690,13 +144325,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -139853,7 +144491,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -139870,7 +144510,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -139888,12 +144531,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -139924,7 +144569,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -139935,11 +144581,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -139965,7 +144612,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -140048,7 +144700,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -140083,11 +144735,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -140124,7 +144777,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -140175,7 +144829,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -140190,7 +144851,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -140369,8 +145030,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -140381,7 +145042,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -140473,13 +145134,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -140636,7 +145300,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -140653,7 +145319,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -140671,12 +145340,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -140707,7 +145378,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -140718,11 +145390,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -140748,7 +145421,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -140831,7 +145509,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -140866,11 +145544,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -140907,7 +145586,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -140958,7 +145638,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -140973,7 +145660,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -141152,8 +145839,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -141164,7 +145851,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -141256,13 +145943,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -141419,7 +146109,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -141436,7 +146128,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -141454,12 +146149,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -141490,7 +146187,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -141501,11 +146199,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -141531,7 +146230,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -141614,7 +146318,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -141649,11 +146353,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -141690,7 +146395,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -141741,7 +146447,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -141756,7 +146469,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -141935,8 +146648,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -141947,7 +146660,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -142039,13 +146752,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -142202,7 +146918,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -142219,7 +146937,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -142237,12 +146958,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -142273,7 +146996,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -142284,11 +147008,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -142314,7 +147039,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -142397,7 +147127,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -142432,11 +147162,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -142473,7 +147204,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -142524,7 +147256,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -142539,7 +147278,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -142718,8 +147457,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -142730,7 +147469,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -142822,13 +147561,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -142985,7 +147727,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -143002,7 +147746,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -143020,12 +147767,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -143056,7 +147805,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -143067,11 +147817,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -143097,7 +147848,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -143180,7 +147936,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -143215,11 +147971,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -143256,7 +148013,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -143307,7 +148065,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -143322,7 +148087,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -143501,8 +148266,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -143513,7 +148278,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -143605,13 +148370,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -143768,7 +148536,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -143785,7 +148555,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -143803,12 +148576,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -143839,7 +148614,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -143850,11 +148626,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -143880,7 +148657,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -143963,7 +148745,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -143998,11 +148780,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -144039,7 +148822,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -144090,7 +148874,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -144105,7 +148896,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -144284,8 +149075,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -144296,7 +149087,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -144388,13 +149179,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -144551,7 +149345,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -144568,7 +149364,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -144586,12 +149385,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -144622,7 +149423,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -144633,11 +149435,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -144663,7 +149466,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -144746,7 +149554,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -144781,11 +149589,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -144822,7 +149631,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -144873,7 +149683,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -144888,7 +149705,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -145067,8 +149884,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -145079,7 +149896,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -145171,13 +149988,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -145334,7 +150154,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -145351,7 +150173,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -145369,12 +150194,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -145405,7 +150232,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -145416,11 +150244,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -145446,7 +150275,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -145529,7 +150363,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -145564,11 +150398,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -145605,7 +150440,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -145656,7 +150492,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -145671,7 +150514,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -145850,8 +150693,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -145862,7 +150705,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -145954,13 +150797,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -146117,7 +150963,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -146134,7 +150982,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -146152,12 +151003,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -146188,7 +151041,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -146199,11 +151053,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -146229,7 +151084,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -146312,7 +151172,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -146347,11 +151207,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -146388,7 +151249,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -146439,7 +151301,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -146454,7 +151323,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -146633,8 +151502,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -146645,7 +151514,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -146737,13 +151606,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -146900,7 +151772,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -146917,7 +151791,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -146935,12 +151812,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -146971,7 +151850,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -146982,11 +151862,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -147012,7 +151893,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -147095,7 +151981,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -147130,11 +152016,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -147171,7 +152058,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -147222,7 +152110,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -147237,7 +152132,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -147416,8 +152311,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -147428,7 +152323,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -147520,13 +152415,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -147683,7 +152581,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -147700,7 +152600,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -147718,12 +152621,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -147754,7 +152659,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -147765,11 +152671,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -147795,7 +152702,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -147878,7 +152790,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -147913,11 +152825,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -147954,7 +152867,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -148005,7 +152919,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -148020,7 +152941,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -148199,8 +153120,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -148211,7 +153132,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -148303,13 +153224,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -148466,7 +153390,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -148483,7 +153409,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -148501,12 +153430,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -148537,7 +153468,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -148548,11 +153480,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -148578,7 +153511,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -148661,7 +153599,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -148696,11 +153634,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -148737,7 +153676,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -148788,7 +153728,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -148803,7 +153750,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -148982,8 +153929,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -148994,7 +153941,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -149086,13 +154033,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -149249,7 +154199,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -149266,7 +154218,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -149284,12 +154239,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -149320,7 +154277,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -149331,11 +154289,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -149361,7 +154320,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -149444,7 +154408,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -149479,11 +154443,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -149520,7 +154485,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -149571,7 +154537,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -149586,7 +154559,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -149765,8 +154738,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -149777,7 +154750,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -149869,13 +154842,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -150032,7 +155008,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -150049,7 +155027,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -150067,12 +155048,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -150103,7 +155086,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -150114,11 +155098,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -150144,7 +155129,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -150227,7 +155217,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -150262,11 +155252,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -150303,7 +155294,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -150354,7 +155346,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -150369,7 +155368,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -150548,8 +155547,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -150560,7 +155559,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -150652,13 +155651,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -150815,7 +155817,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -150832,7 +155836,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -150850,12 +155857,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -150886,7 +155895,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -150897,11 +155907,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -150927,7 +155938,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -151010,7 +156026,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -151045,11 +156061,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -151086,7 +156103,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -151137,7 +156155,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -151152,7 +156177,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -151331,8 +156356,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -151343,7 +156368,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -151435,13 +156460,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -151598,7 +156626,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -151615,7 +156645,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -151633,12 +156666,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -151669,7 +156704,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -151680,11 +156716,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -151710,7 +156747,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -151793,7 +156835,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -151828,11 +156870,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -151869,7 +156912,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -151920,7 +156964,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -151935,7 +156986,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -152114,8 +157165,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -152126,7 +157177,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -152218,13 +157269,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -152381,7 +157435,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -152398,7 +157454,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -152416,12 +157475,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -152452,7 +157513,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -152463,11 +157525,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -152493,7 +157556,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -152576,7 +157644,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -152611,11 +157679,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -152652,7 +157721,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -152703,7 +157773,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -152718,7 +157795,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -152897,8 +157974,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -152909,7 +157986,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -153001,13 +158078,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -153164,7 +158244,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -153181,7 +158263,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -153199,12 +158284,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -153235,7 +158322,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -153246,11 +158334,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -153276,7 +158365,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -153359,7 +158453,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -153394,11 +158488,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -153435,7 +158530,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -153486,7 +158582,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -153501,7 +158604,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -153680,8 +158783,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -153692,7 +158795,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -153784,13 +158887,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -153947,7 +159053,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -153964,7 +159072,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -153982,12 +159093,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -154018,7 +159131,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -154029,11 +159143,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -154059,7 +159174,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -154142,7 +159262,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -154177,11 +159297,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -154218,7 +159339,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -154269,7 +159391,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -154284,7 +159413,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -154463,8 +159592,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -154475,7 +159604,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -154567,13 +159696,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -154730,7 +159862,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -154747,7 +159881,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -154765,12 +159902,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -154801,7 +159940,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -154812,11 +159952,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -154842,7 +159983,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -154925,7 +160071,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -154960,11 +160106,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -155001,7 +160148,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -155052,7 +160200,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -155067,7 +160222,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -155246,8 +160401,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -155258,7 +160413,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -155350,13 +160505,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -155513,7 +160671,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -155530,7 +160690,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -155548,12 +160711,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -155584,7 +160749,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -155595,11 +160761,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -155625,7 +160792,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -155708,7 +160880,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -155743,11 +160915,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -155784,7 +160957,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -155835,7 +161009,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -155850,7 +161031,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -156029,8 +161210,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -156041,7 +161222,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -156133,13 +161314,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -156296,7 +161480,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -156313,7 +161499,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -156331,12 +161520,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -156367,7 +161558,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -156378,11 +161570,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -156408,7 +161601,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -156491,7 +161689,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -156526,11 +161724,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -156567,7 +161766,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -156618,7 +161818,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -156633,7 +161840,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -156812,8 +162019,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -156824,7 +162031,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -156916,13 +162123,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -157079,7 +162289,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -157096,7 +162308,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -157114,12 +162329,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -157150,7 +162367,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -157161,11 +162379,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -157191,7 +162410,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -157274,7 +162498,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -157309,11 +162533,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -157350,7 +162575,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -157401,7 +162627,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -157416,7 +162649,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -157595,8 +162828,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -157607,7 +162840,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -157699,13 +162932,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -157862,7 +163098,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -157879,7 +163117,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -157897,12 +163138,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -157933,7 +163176,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -157944,11 +163188,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -157974,7 +163219,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -158057,7 +163307,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -158092,11 +163342,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -158133,7 +163384,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -158184,7 +163436,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -158199,7 +163458,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -158378,8 +163637,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -158390,7 +163649,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -158482,13 +163741,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -158645,7 +163907,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -158662,7 +163926,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -158680,12 +163947,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -158716,7 +163985,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -158727,11 +163997,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -158757,7 +164028,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -158840,7 +164116,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -158875,11 +164151,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -158916,7 +164193,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -158967,7 +164245,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -158982,7 +164267,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -159161,8 +164446,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -159173,7 +164458,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -159265,13 +164550,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -159428,7 +164716,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -159445,7 +164735,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -159463,12 +164756,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -159499,7 +164794,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -159510,11 +164806,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -159540,7 +164837,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -159623,7 +164925,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -159658,11 +164960,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -159699,7 +165002,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -159750,7 +165054,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -159765,7 +165076,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -159944,8 +165255,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -159956,7 +165267,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -160048,13 +165359,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -160211,7 +165525,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -160228,7 +165544,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -160246,12 +165565,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -160282,7 +165603,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -160293,11 +165615,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -160323,7 +165646,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -160406,7 +165734,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -160441,11 +165769,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -160482,7 +165811,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -160533,7 +165863,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -160548,7 +165885,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -160727,8 +166064,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -160739,7 +166076,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -160831,13 +166168,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -160994,7 +166334,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -161011,7 +166353,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -161029,12 +166374,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -161065,7 +166412,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -161076,11 +166424,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -161106,7 +166455,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -161189,7 +166543,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -161224,11 +166578,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -161265,7 +166620,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -161316,7 +166672,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -161331,7 +166694,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -161510,8 +166873,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -161522,7 +166885,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -161614,13 +166977,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -161777,7 +167143,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -161794,7 +167162,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -161812,12 +167183,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -161848,7 +167221,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -161859,11 +167233,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -161889,7 +167264,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -161972,7 +167352,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -162007,11 +167387,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -162048,7 +167429,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -162099,7 +167481,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -162114,7 +167503,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -162293,8 +167682,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -162305,7 +167694,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -162397,13 +167786,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -162560,7 +167952,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -162577,7 +167971,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -162595,12 +167992,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -162631,7 +168030,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -162642,11 +168042,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -162672,7 +168073,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -162755,7 +168161,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -162790,11 +168196,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -162831,7 +168238,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -162882,7 +168290,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -162897,7 +168312,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -163076,8 +168491,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -163088,7 +168503,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -163180,13 +168595,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -163343,7 +168761,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -163360,7 +168780,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -163378,12 +168801,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -163414,7 +168839,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -163425,11 +168851,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -163455,7 +168882,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -163538,7 +168970,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -163573,11 +169005,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -163614,7 +169047,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -163665,7 +169099,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -163680,7 +169121,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -163859,8 +169300,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -163871,7 +169312,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -163963,13 +169404,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -164126,7 +169570,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -164143,7 +169589,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -164161,12 +169610,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -164197,7 +169648,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -164208,11 +169660,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -164238,7 +169691,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -164321,7 +169779,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -164356,11 +169814,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -164397,7 +169856,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -164448,7 +169908,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -164463,7 +169930,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -164642,8 +170109,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -164654,7 +170121,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -164746,13 +170213,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -164909,7 +170379,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -164926,7 +170398,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -164944,12 +170419,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -164980,7 +170457,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -164991,11 +170469,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -165021,7 +170500,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -165104,7 +170588,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -165139,11 +170623,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -165180,7 +170665,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -165231,7 +170717,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -165246,7 +170739,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -165425,8 +170918,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -165437,7 +170930,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -165529,13 +171022,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -165692,7 +171188,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -165709,7 +171207,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -165727,12 +171228,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -165763,7 +171266,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -165774,11 +171278,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -165804,7 +171309,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -165887,7 +171397,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -165922,11 +171432,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -165963,7 +171474,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -166014,7 +171526,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -166029,7 +171548,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -166208,8 +171727,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -166220,7 +171739,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -166312,13 +171831,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -166475,7 +171997,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -166492,7 +172016,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -166510,12 +172037,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -166546,7 +172075,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -166557,11 +172087,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -166587,7 +172118,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -166670,7 +172206,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -166705,11 +172241,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -166746,7 +172283,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -166797,7 +172335,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -166812,7 +172357,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -166991,8 +172536,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -167003,7 +172548,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -167095,13 +172640,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -167258,7 +172806,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -167275,7 +172825,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -167293,12 +172846,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -167329,7 +172884,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -167340,11 +172896,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -167370,7 +172927,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -167453,7 +173015,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -167488,11 +173050,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -167529,7 +173092,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -167580,7 +173144,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -167595,7 +173166,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -167774,8 +173345,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -167786,7 +173357,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -167878,13 +173449,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -168041,7 +173615,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -168058,7 +173634,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -168076,12 +173655,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -168112,7 +173693,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -168123,11 +173705,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -168153,7 +173736,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -168236,7 +173824,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -168271,11 +173859,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -168312,7 +173901,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -168363,7 +173953,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -168378,7 +173975,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -168557,8 +174154,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -168569,7 +174166,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -168661,13 +174258,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -168824,7 +174424,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -168841,7 +174443,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -168859,12 +174464,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -168895,7 +174502,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -168906,11 +174514,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -168936,7 +174545,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -169019,7 +174633,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -169054,11 +174668,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -169095,7 +174710,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -169146,7 +174762,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -169161,7 +174784,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -169340,8 +174963,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -169352,7 +174975,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -169444,13 +175067,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -169607,7 +175233,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -169624,7 +175252,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -169642,12 +175273,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -169678,7 +175311,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -169689,11 +175323,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -169719,7 +175354,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -169802,7 +175442,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -169837,11 +175477,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -169878,7 +175519,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -169929,7 +175571,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -169944,7 +175593,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -170123,8 +175772,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -170135,7 +175784,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -170227,13 +175876,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -170390,7 +176042,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -170407,7 +176061,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -170425,12 +176082,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -170461,7 +176120,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -170472,11 +176132,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -170502,7 +176163,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -170585,7 +176251,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -170620,11 +176286,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -170661,7 +176328,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -170712,7 +176380,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -170727,7 +176402,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -170906,8 +176581,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -170918,7 +176593,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -171010,13 +176685,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -171173,7 +176851,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -171190,7 +176870,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -171208,12 +176891,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -171244,7 +176929,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -171255,11 +176941,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -171285,7 +176972,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -171368,7 +177060,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -171403,11 +177095,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -171444,7 +177137,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -171495,7 +177189,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -171510,7 +177211,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -171689,8 +177390,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -171701,7 +177402,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -171793,13 +177494,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -171956,7 +177660,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -171973,7 +177679,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -171991,12 +177700,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -172027,7 +177738,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -172038,11 +177750,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -172068,7 +177781,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -172151,7 +177869,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -172186,11 +177904,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -172227,7 +177946,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -172278,7 +177998,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -172293,7 +178020,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -172472,8 +178199,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -172484,7 +178211,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -172576,13 +178303,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -172739,7 +178469,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -172756,7 +178488,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -172774,12 +178509,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -172810,7 +178547,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -172821,11 +178559,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -172851,7 +178590,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -172934,7 +178678,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -172969,11 +178713,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -173010,7 +178755,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -173061,7 +178807,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -173076,7 +178829,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -173255,8 +179008,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -173267,7 +179020,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -173359,13 +179112,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -173522,7 +179278,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -173539,7 +179297,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -173557,12 +179318,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -173593,7 +179356,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -173604,11 +179368,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -173634,7 +179399,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -173717,7 +179487,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -173752,11 +179522,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -173793,7 +179564,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -173844,7 +179616,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -173859,7 +179638,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -174038,8 +179817,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -174050,7 +179829,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -174142,13 +179921,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -174305,7 +180087,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -174322,7 +180106,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -174340,12 +180127,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -174376,7 +180165,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -174387,11 +180177,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -174417,7 +180208,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -174500,7 +180296,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -174535,11 +180331,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -174576,7 +180373,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -174627,7 +180425,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -174642,7 +180447,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -174821,8 +180626,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -174833,7 +180638,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -174925,13 +180730,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -175088,7 +180896,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -175105,7 +180915,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -175123,12 +180936,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -175159,7 +180974,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -175170,11 +180986,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -175200,7 +181017,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -175283,7 +181105,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -175318,11 +181140,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -175359,7 +181182,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -175410,7 +181234,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -175425,7 +181256,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -175604,8 +181435,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -175616,7 +181447,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -175708,13 +181539,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -175871,7 +181705,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -175888,7 +181724,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -175906,12 +181745,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -175942,7 +181783,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -175953,11 +181795,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -175983,7 +181826,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -176066,7 +181914,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -176101,11 +181949,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -176142,7 +181991,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -176193,7 +182043,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -176208,7 +182065,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -176387,8 +182244,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -176399,7 +182256,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -176491,13 +182348,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -176654,7 +182514,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -176671,7 +182533,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -176689,12 +182554,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -176725,7 +182592,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -176736,11 +182604,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -176766,7 +182635,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -176849,7 +182723,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -176884,11 +182758,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -176925,7 +182800,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -176976,7 +182852,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -176991,7 +182874,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -177170,8 +183053,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -177182,7 +183065,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -177274,13 +183157,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -177437,7 +183323,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -177454,7 +183342,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -177472,12 +183363,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -177508,7 +183401,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -177519,11 +183413,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -177549,7 +183444,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -177632,7 +183532,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -177667,11 +183567,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -177708,7 +183609,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -177759,7 +183661,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -177774,7 +183683,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -177953,8 +183862,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -177965,7 +183874,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -178057,13 +183966,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -178220,7 +184132,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -178237,7 +184151,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -178255,12 +184172,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -178291,7 +184210,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -178302,11 +184222,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -178332,7 +184253,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -178415,7 +184341,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -178450,11 +184376,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -178491,7 +184418,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -178542,7 +184470,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -178557,7 +184492,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -178736,8 +184671,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -178748,7 +184683,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -178840,13 +184775,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -179003,7 +184941,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -179020,7 +184960,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -179038,12 +184981,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -179074,7 +185019,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -179085,11 +185031,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -179115,7 +185062,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -179198,7 +185150,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -179233,11 +185185,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -179274,7 +185227,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -179325,7 +185279,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -179340,7 +185301,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -179519,8 +185480,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -179531,7 +185492,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -179623,13 +185584,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -179786,7 +185750,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -179803,7 +185769,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -179821,12 +185790,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -179857,7 +185828,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -179868,11 +185840,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -179898,7 +185871,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -179981,7 +185959,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -180016,11 +185994,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -180057,7 +186036,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -180108,7 +186088,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -180123,7 +186110,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -180302,8 +186289,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -180314,7 +186301,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -180406,13 +186393,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -180569,7 +186559,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -180586,7 +186578,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -180604,12 +186599,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -180640,7 +186637,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -180651,11 +186649,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -180681,7 +186680,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -180764,7 +186768,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -180799,11 +186803,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -180840,7 +186845,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -180891,7 +186897,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -180906,7 +186919,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -181085,8 +187098,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -181097,7 +187110,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -181189,13 +187202,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -181352,7 +187368,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -181369,7 +187387,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -181387,12 +187408,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -181423,7 +187446,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -181434,11 +187458,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -181464,7 +187489,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -181547,7 +187577,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -181582,11 +187612,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -181623,7 +187654,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -181674,7 +187706,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -181689,7 +187728,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -181868,8 +187907,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -181880,7 +187919,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -181972,13 +188011,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -182135,7 +188177,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -182152,7 +188196,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -182170,12 +188217,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -182206,7 +188255,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -182217,11 +188267,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -182247,7 +188298,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -182330,7 +188386,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -182365,11 +188421,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -182406,7 +188463,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -182457,7 +188515,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -182472,7 +188537,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -182651,8 +188716,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -182663,7 +188728,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -182755,13 +188820,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -182918,7 +188986,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -182935,7 +189005,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -182953,12 +189026,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -182989,7 +189064,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -183000,11 +189076,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -183030,7 +189107,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -183113,7 +189195,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -183148,11 +189230,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -183189,7 +189272,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -183240,7 +189324,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -183255,7 +189346,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -183434,8 +189525,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -183446,7 +189537,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -183538,13 +189629,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -183701,7 +189795,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -183718,7 +189814,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -183736,12 +189835,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -183772,7 +189873,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -183783,11 +189885,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -183813,7 +189916,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -183896,7 +190004,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -183931,11 +190039,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -183972,7 +190081,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -184023,7 +190133,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -184038,7 +190155,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -184217,8 +190334,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -184229,7 +190346,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -184321,13 +190438,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -184484,7 +190604,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -184501,7 +190623,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -184519,12 +190644,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -184555,7 +190682,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -184566,11 +190694,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -184596,7 +190725,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -184679,7 +190813,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -184714,11 +190848,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -184755,7 +190890,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -184806,7 +190942,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -184821,7 +190964,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -185000,8 +191143,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -185012,7 +191155,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -185104,13 +191247,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -185267,7 +191413,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -185284,7 +191432,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -185302,12 +191453,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -185338,7 +191491,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -185349,11 +191503,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -185379,7 +191534,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -185462,7 +191622,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -185497,11 +191657,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -185538,7 +191699,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -185589,7 +191751,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -185604,7 +191773,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -185783,8 +191952,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -185795,7 +191964,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -185887,13 +192056,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -186050,7 +192222,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -186067,7 +192241,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -186085,12 +192262,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -186121,7 +192300,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -186132,11 +192312,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -186162,7 +192343,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -186245,7 +192431,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -186280,11 +192466,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -186321,7 +192508,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -186372,7 +192560,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -186387,7 +192582,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -186566,8 +192761,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -186578,7 +192773,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -186670,13 +192865,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -186833,7 +193031,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -186850,7 +193050,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -186868,12 +193071,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -186904,7 +193109,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -186915,11 +193121,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -186945,7 +193152,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -187028,7 +193240,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -187063,11 +193275,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -187104,7 +193317,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -187155,7 +193369,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -187170,7 +193391,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -187349,8 +193570,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -187361,7 +193582,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -187453,13 +193674,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -187616,7 +193840,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -187633,7 +193859,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -187651,12 +193880,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -187687,7 +193918,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -187698,11 +193930,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -187728,7 +193961,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -187811,7 +194049,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -187846,11 +194084,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -187887,7 +194126,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -187938,7 +194178,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -187953,7 +194200,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -188132,8 +194379,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -188144,7 +194391,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -188236,13 +194483,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -188399,7 +194649,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -188416,7 +194668,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -188434,12 +194689,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -188470,7 +194727,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -188481,11 +194739,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -188511,7 +194770,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -188594,7 +194858,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -188629,11 +194893,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -188670,7 +194935,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -188721,7 +194987,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -188736,7 +195009,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -188915,8 +195188,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -188927,7 +195200,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -189019,13 +195292,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -189182,7 +195458,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -189199,7 +195477,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -189217,12 +195498,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -189253,7 +195536,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -189264,11 +195548,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -189294,7 +195579,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -189377,7 +195667,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -189412,11 +195702,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -189453,7 +195744,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -189504,7 +195796,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -189519,7 +195818,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -189698,8 +195997,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -189710,7 +196009,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -189802,13 +196101,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -189965,7 +196267,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -189982,7 +196286,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -190000,12 +196307,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -190036,7 +196345,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -190047,11 +196357,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -190077,7 +196388,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -190160,7 +196476,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -190195,11 +196511,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -190236,7 +196553,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -190287,7 +196605,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -190302,7 +196627,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -190481,8 +196806,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -190493,7 +196818,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -190585,13 +196910,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -190748,7 +197076,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -190765,7 +197095,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -190783,12 +197116,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -190819,7 +197154,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -190830,11 +197166,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -190860,7 +197197,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -190943,7 +197285,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -190978,11 +197320,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -191019,7 +197362,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -191070,7 +197414,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -191085,7 +197436,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -191264,8 +197615,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -191276,7 +197627,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -191368,13 +197719,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -191531,7 +197885,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -191548,7 +197904,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -191566,12 +197925,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -191602,7 +197963,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -191613,11 +197975,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -191643,7 +198006,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -191726,7 +198094,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -191761,11 +198129,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -191802,7 +198171,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -191853,7 +198223,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -191868,7 +198245,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -192047,8 +198424,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -192059,7 +198436,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -192151,13 +198528,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -192314,7 +198694,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -192331,7 +198713,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -192349,12 +198734,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -192385,7 +198772,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -192396,11 +198784,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -192426,7 +198815,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -192509,7 +198903,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -192544,11 +198938,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -192585,7 +198980,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -192636,7 +199032,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -192651,7 +199054,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -192830,8 +199233,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -192842,7 +199245,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -192934,13 +199337,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -193097,7 +199503,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -193114,7 +199522,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -193132,12 +199543,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -193168,7 +199581,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -193179,11 +199593,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -193209,7 +199624,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -193292,7 +199712,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -193327,11 +199747,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -193368,7 +199789,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -193419,7 +199841,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -193434,7 +199863,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -193613,8 +200042,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -193625,7 +200054,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -193717,13 +200146,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -193880,7 +200312,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -193897,7 +200331,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -193915,12 +200352,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -193951,7 +200390,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -193962,11 +200402,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -193992,7 +200433,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -194075,7 +200521,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -194110,11 +200556,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -194151,7 +200598,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -194202,7 +200650,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -194217,7 +200672,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -194396,8 +200851,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -194408,7 +200863,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -194500,13 +200955,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -194663,7 +201121,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -194680,7 +201140,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -194698,12 +201161,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -194734,7 +201199,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -194745,11 +201211,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -194775,7 +201242,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -194858,7 +201330,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -194893,11 +201365,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -194934,7 +201407,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -194985,7 +201459,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -195000,7 +201481,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -195179,8 +201660,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -195191,7 +201672,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -195283,13 +201764,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -195446,7 +201930,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -195463,7 +201949,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -195481,12 +201970,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -195517,7 +202008,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -195528,11 +202020,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -195558,7 +202051,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -195641,7 +202139,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -195676,11 +202174,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -195717,7 +202216,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -195768,7 +202268,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -195783,7 +202290,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -195962,8 +202469,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -195974,7 +202481,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -196066,13 +202573,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -196229,7 +202739,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -196246,7 +202758,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -196264,12 +202779,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -196300,7 +202817,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -196311,11 +202829,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -196341,7 +202860,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -196424,7 +202948,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -196459,11 +202983,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -196500,7 +203025,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -196551,7 +203077,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -196566,7 +203099,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -196745,8 +203278,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -196757,7 +203290,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -196849,13 +203382,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -197012,7 +203548,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -197029,7 +203567,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -197047,12 +203588,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -197083,7 +203626,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -197094,11 +203638,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -197124,7 +203669,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -197207,7 +203757,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -197242,11 +203792,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -197283,7 +203834,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -197334,7 +203886,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -197349,7 +203908,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -197528,8 +204087,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -197540,7 +204099,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -197632,13 +204191,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -197795,7 +204357,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -197812,7 +204376,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -197830,12 +204397,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -197866,7 +204435,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -197877,11 +204447,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -197907,7 +204478,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -197990,7 +204566,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -198025,11 +204601,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -198066,7 +204643,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -198117,7 +204695,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -198132,7 +204717,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -198311,8 +204896,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -198323,7 +204908,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -198415,13 +205000,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -198578,7 +205166,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -198595,7 +205185,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -198613,12 +205206,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -198649,7 +205244,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -198660,11 +205256,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -198690,7 +205287,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -198773,7 +205375,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -198808,11 +205410,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -198849,7 +205452,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -198900,7 +205504,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -198915,7 +205526,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -199094,8 +205705,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -199106,7 +205717,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -199198,13 +205809,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -199361,7 +205975,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -199378,7 +205994,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -199396,12 +206015,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -199432,7 +206053,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -199443,11 +206065,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -199473,7 +206096,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -199556,7 +206184,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -199591,11 +206219,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -199632,7 +206261,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -199683,7 +206313,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -199698,7 +206335,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -199877,8 +206514,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -199889,7 +206526,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -199981,13 +206618,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -200144,7 +206784,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -200161,7 +206803,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -200179,12 +206824,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -200215,7 +206862,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -200226,11 +206874,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -200256,7 +206905,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -200339,7 +206993,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -200374,11 +207028,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -200415,7 +207070,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -200466,7 +207122,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -200481,7 +207144,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -200660,8 +207323,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -200672,7 +207335,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -200764,13 +207427,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -200927,7 +207593,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -200944,7 +207612,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -200962,12 +207633,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -200998,7 +207671,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -201009,11 +207683,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -201039,7 +207714,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -201122,7 +207802,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -201157,11 +207837,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -201198,7 +207879,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -201249,7 +207931,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -201264,7 +207953,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -201443,8 +208132,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -201455,7 +208144,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -201547,13 +208236,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -201710,7 +208402,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -201727,7 +208421,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -201745,12 +208442,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -201781,7 +208480,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -201792,11 +208492,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -201822,7 +208523,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -201905,7 +208611,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -201940,11 +208646,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -201981,7 +208688,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -202032,7 +208740,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -202047,7 +208762,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -202226,8 +208941,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -202238,7 +208953,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -202330,13 +209045,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -202493,7 +209211,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -202510,7 +209230,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -202528,12 +209251,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -202564,7 +209289,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -202575,11 +209301,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -202605,7 +209332,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -202688,7 +209420,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -202723,11 +209455,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -202764,7 +209497,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -202815,7 +209549,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -202830,7 +209571,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -203009,8 +209750,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -203021,7 +209762,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -203113,13 +209854,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -203276,7 +210020,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -203293,7 +210039,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -203311,12 +210060,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -203347,7 +210098,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -203358,11 +210110,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -203388,7 +210141,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -203471,7 +210229,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -203506,11 +210264,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -203547,7 +210306,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -203598,7 +210358,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -203613,7 +210380,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -203792,8 +210559,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -203804,7 +210571,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -203896,13 +210663,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -204059,7 +210829,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -204076,7 +210848,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -204094,12 +210869,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -204130,7 +210907,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -204141,11 +210919,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -204171,7 +210950,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -204254,7 +211038,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -204289,11 +211073,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -204330,7 +211115,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -204381,7 +211167,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -204396,7 +211189,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -204575,8 +211368,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -204587,7 +211380,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -204679,13 +211472,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -204842,7 +211638,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -204859,7 +211657,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -204877,12 +211678,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -204913,7 +211716,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -204924,11 +211728,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -204954,7 +211759,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -205037,7 +211847,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -205072,11 +211882,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -205113,7 +211924,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -205164,7 +211976,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -205179,7 +211998,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -205358,8 +212177,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -205370,7 +212189,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -205462,13 +212281,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -205625,7 +212447,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -205642,7 +212466,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -205660,12 +212487,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -205696,7 +212525,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -205707,11 +212537,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -205737,7 +212568,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -205820,7 +212656,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -205855,11 +212691,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -205896,7 +212733,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -205947,7 +212785,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -205962,7 +212807,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -206141,8 +212986,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -206153,7 +212998,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -206245,13 +213090,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -206408,7 +213256,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -206425,7 +213275,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -206443,12 +213296,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -206479,7 +213334,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -206490,11 +213346,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -206520,7 +213377,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -206603,7 +213465,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -206638,11 +213500,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -206679,7 +213542,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -206730,7 +213594,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -206745,7 +213616,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -206924,8 +213795,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -206936,7 +213807,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -207028,13 +213899,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -207191,7 +214065,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -207208,7 +214084,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -207226,12 +214105,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -207262,7 +214143,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -207273,11 +214155,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -207303,7 +214186,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -207386,7 +214274,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -207421,11 +214309,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -207462,7 +214351,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -207513,7 +214403,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -207528,7 +214425,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -207707,8 +214604,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -207719,7 +214616,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -207811,13 +214708,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -207974,7 +214874,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -207991,7 +214893,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -208009,12 +214914,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -208045,7 +214952,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -208056,11 +214964,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -208086,7 +214995,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -208169,7 +215083,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -208204,11 +215118,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -208245,7 +215160,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -208296,7 +215212,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -208311,7 +215234,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -208490,8 +215413,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -208502,7 +215425,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -208594,13 +215517,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -208757,7 +215683,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -208774,7 +215702,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -208792,12 +215723,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -208828,7 +215761,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -208839,11 +215773,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -208869,7 +215804,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -208952,7 +215892,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -208987,11 +215927,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -209028,7 +215969,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -209079,7 +216021,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -209094,7 +216043,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -209273,8 +216222,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -209285,7 +216234,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -209377,13 +216326,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -209540,7 +216492,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -209557,7 +216511,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -209575,12 +216532,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -209611,7 +216570,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -209622,11 +216582,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -209652,7 +216613,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -209735,7 +216701,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -209770,11 +216736,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -209811,7 +216778,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -209862,7 +216830,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -209877,7 +216852,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -210056,8 +217031,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -210068,7 +217043,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -210160,13 +217135,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -210323,7 +217301,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -210340,7 +217320,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -210358,12 +217341,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -210394,7 +217379,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -210405,11 +217391,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -210435,7 +217422,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -210518,7 +217510,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -210553,11 +217545,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -210594,7 +217587,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -210645,7 +217639,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -210660,7 +217661,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -210839,8 +217840,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -210851,7 +217852,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -210943,13 +217944,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -211106,7 +218110,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -211123,7 +218129,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -211141,12 +218150,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -211177,7 +218188,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -211188,11 +218200,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -211218,7 +218231,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -211301,7 +218319,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -211336,11 +218354,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -211377,7 +218396,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -211428,7 +218448,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -211443,7 +218470,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -211622,8 +218649,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -211634,7 +218661,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -211726,13 +218753,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -211889,7 +218919,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -211906,7 +218938,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -211924,12 +218959,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -211960,7 +218997,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -211971,11 +219009,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -212001,7 +219040,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -212084,7 +219128,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -212119,11 +219163,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -212160,7 +219205,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -212211,7 +219257,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -212226,7 +219279,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -212405,8 +219458,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -212417,7 +219470,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -212509,13 +219562,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -212672,7 +219728,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -212689,7 +219747,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -212707,12 +219768,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -212743,7 +219806,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -212754,11 +219818,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -212784,7 +219849,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -212867,7 +219937,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -212902,11 +219972,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -212943,7 +220014,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -212994,7 +220066,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -213009,7 +220088,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -213188,8 +220267,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -213200,7 +220279,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -213292,13 +220371,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -213455,7 +220537,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -213472,7 +220556,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -213490,12 +220577,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -213526,7 +220615,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -213537,11 +220627,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -213567,7 +220658,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -213650,7 +220746,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -213685,11 +220781,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -213726,7 +220823,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -213777,7 +220875,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -213792,7 +220897,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -213971,8 +221076,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -213983,7 +221088,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -214075,13 +221180,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -214238,7 +221346,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -214255,7 +221365,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -214273,12 +221386,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -214309,7 +221424,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -214320,11 +221436,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -214350,7 +221467,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -214433,7 +221555,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -214468,11 +221590,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -214509,7 +221632,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -214560,7 +221684,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -214575,7 +221706,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -214754,8 +221885,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -214766,7 +221897,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -214858,13 +221989,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -215021,7 +222155,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -215038,7 +222174,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -215056,12 +222195,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -215092,7 +222233,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -215103,11 +222245,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -215133,7 +222276,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -215216,7 +222364,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -215251,11 +222399,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -215292,7 +222441,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -215343,7 +222493,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -215358,7 +222515,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -215537,8 +222694,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -215549,7 +222706,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -215641,13 +222798,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -215804,7 +222964,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -215821,7 +222983,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -215839,12 +223004,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -215875,7 +223042,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -215886,11 +223054,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -215916,7 +223085,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -215999,7 +223173,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -216034,11 +223208,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -216075,7 +223250,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -216126,7 +223302,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -216141,7 +223324,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -216320,8 +223503,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -216332,7 +223515,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -216424,13 +223607,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -216587,7 +223773,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -216604,7 +223792,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -216622,12 +223813,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -216658,7 +223851,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -216669,11 +223863,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -216699,7 +223894,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -216782,7 +223982,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -216817,11 +224017,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -216858,7 +224059,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -216909,7 +224111,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -216924,7 +224133,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -217103,8 +224312,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -217115,7 +224324,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -217207,13 +224416,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -217370,7 +224582,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -217387,7 +224601,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -217405,12 +224622,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -217441,7 +224660,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -217452,11 +224672,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -217482,7 +224703,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -217565,7 +224791,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -217600,11 +224826,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -217641,7 +224868,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -217692,7 +224920,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -217707,7 +224942,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -217886,8 +225121,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -217898,7 +225133,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -217990,13 +225225,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -218153,7 +225391,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -218170,7 +225410,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -218188,12 +225431,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -218224,7 +225469,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -218235,11 +225481,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -218265,7 +225512,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -218348,7 +225600,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -218383,11 +225635,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -218424,7 +225677,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -218475,7 +225729,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -218490,7 +225751,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -218669,8 +225930,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -218681,7 +225942,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -218773,13 +226034,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -218936,7 +226200,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -218953,7 +226219,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -218971,12 +226240,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -219007,7 +226278,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -219018,11 +226290,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -219048,7 +226321,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -219131,7 +226409,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -219166,11 +226444,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -219207,7 +226486,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -219258,7 +226538,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -219273,7 +226560,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -219452,8 +226739,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -219464,7 +226751,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -219556,13 +226843,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -219719,7 +227009,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -219736,7 +227028,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -219754,12 +227049,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -219790,7 +227087,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -219801,11 +227099,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -219831,7 +227130,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -219914,7 +227218,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -219949,11 +227253,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -219990,7 +227295,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -220041,7 +227347,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -220056,7 +227369,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -220235,8 +227548,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -220247,7 +227560,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -220339,13 +227652,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -220502,7 +227818,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -220519,7 +227837,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -220537,12 +227858,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -220573,7 +227896,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -220584,11 +227908,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -220614,7 +227939,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -220697,7 +228027,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -220732,11 +228062,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -220773,7 +228104,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -220824,7 +228156,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -220839,7 +228178,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -221018,8 +228357,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -221030,7 +228369,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -221122,13 +228461,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -221285,7 +228627,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -221302,7 +228646,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -221320,12 +228667,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -221356,7 +228705,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -221367,11 +228717,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -221397,7 +228748,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -221480,7 +228836,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -221515,11 +228871,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -221556,7 +228913,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -221607,7 +228965,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -221622,7 +228987,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -221801,8 +229166,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -221813,7 +229178,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -221905,13 +229270,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -222068,7 +229436,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -222085,7 +229455,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -222103,12 +229476,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -222139,7 +229514,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -222150,11 +229526,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -222180,7 +229557,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -222263,7 +229645,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -222298,11 +229680,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -222339,7 +229722,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -222390,7 +229774,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -222405,7 +229796,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -222584,8 +229975,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -222596,7 +229987,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -222688,13 +230079,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -222851,7 +230245,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -222868,7 +230264,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -222886,12 +230285,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -222922,7 +230323,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -222933,11 +230335,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -222963,7 +230366,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -223046,7 +230454,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -223081,11 +230489,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -223122,7 +230531,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -223173,7 +230583,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -223188,7 +230605,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -223367,8 +230784,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -223379,7 +230796,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -223471,13 +230888,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -223634,7 +231054,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -223651,7 +231073,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -223669,12 +231094,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -223705,7 +231132,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -223716,11 +231144,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -223746,7 +231175,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -223829,7 +231263,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -223864,11 +231298,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -223905,7 +231340,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -223956,7 +231392,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -223971,7 +231414,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -224150,8 +231593,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -224162,7 +231605,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -224254,13 +231697,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -224417,7 +231863,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -224434,7 +231882,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -224452,12 +231903,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -224488,7 +231941,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -224499,11 +231953,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -224529,7 +231984,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -224612,7 +232072,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -224647,11 +232107,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -224688,7 +232149,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -224739,7 +232201,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -224754,7 +232223,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -224933,8 +232402,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -224945,7 +232414,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -225037,13 +232506,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -225200,7 +232672,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -225217,7 +232691,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -225235,12 +232712,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -225271,7 +232750,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -225282,11 +232762,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -225312,7 +232793,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -225395,7 +232881,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -225430,11 +232916,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -225471,7 +232958,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -225522,7 +233010,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -225537,7 +233032,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -225716,8 +233211,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -225728,7 +233223,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -225820,13 +233315,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -225983,7 +233481,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -226000,7 +233500,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -226018,12 +233521,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -226054,7 +233559,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -226065,11 +233571,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -226095,7 +233602,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -226178,7 +233690,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -226213,11 +233725,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -226254,7 +233767,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -226305,7 +233819,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -226320,7 +233841,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -226499,8 +234020,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -226511,7 +234032,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -226603,13 +234124,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -226766,7 +234290,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -226783,7 +234309,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -226801,12 +234330,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -226837,7 +234368,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -226848,11 +234380,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -226878,7 +234411,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -226961,7 +234499,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -226996,11 +234534,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -227037,7 +234576,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -227088,7 +234628,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -227103,7 +234650,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -227282,8 +234829,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -227294,7 +234841,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -227386,13 +234933,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -227549,7 +235099,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -227566,7 +235118,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -227584,12 +235139,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -227620,7 +235177,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -227631,11 +235189,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -227661,7 +235220,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -227744,7 +235308,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -227779,11 +235343,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -227820,7 +235385,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -227871,7 +235437,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -227886,7 +235459,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -228065,8 +235638,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -228077,7 +235650,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -228169,13 +235742,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -228332,7 +235908,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -228349,7 +235927,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -228367,12 +235948,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -228403,7 +235986,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -228414,11 +235998,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -228444,7 +236029,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -228527,7 +236117,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -228562,11 +236152,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -228603,7 +236194,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -228654,7 +236246,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -228669,7 +236268,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -228848,8 +236447,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -228860,7 +236459,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -228952,13 +236551,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -229115,7 +236717,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -229132,7 +236736,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -229150,12 +236757,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -229186,7 +236795,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -229197,11 +236807,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -229227,7 +236838,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -229310,7 +236926,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -229345,11 +236961,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -229386,7 +237003,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -229437,7 +237055,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -229452,7 +237077,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -229631,8 +237256,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -229643,7 +237268,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -229735,13 +237360,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -229898,7 +237526,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -229915,7 +237545,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -229933,12 +237566,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -229969,7 +237604,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -229980,11 +237616,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -230010,7 +237647,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -230093,7 +237735,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -230128,11 +237770,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -230169,7 +237812,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -230220,7 +237864,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -230235,7 +237886,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -230414,8 +238065,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -230426,7 +238077,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -230518,13 +238169,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -230681,7 +238335,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -230698,7 +238354,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -230716,12 +238375,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -230752,7 +238413,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -230763,11 +238425,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -230793,7 +238456,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -230876,7 +238544,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -230911,11 +238579,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -230952,7 +238621,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -231003,7 +238673,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -231018,7 +238695,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -231197,8 +238874,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -231209,7 +238886,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -231301,13 +238978,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -231464,7 +239144,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -231481,7 +239163,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -231499,12 +239184,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -231535,7 +239222,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -231546,11 +239234,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -231576,7 +239265,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -231659,7 +239353,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -231694,11 +239388,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -231735,7 +239430,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -231786,7 +239482,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -231801,7 +239504,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -231980,8 +239683,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -231992,7 +239695,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -232084,13 +239787,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -232247,7 +239953,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -232264,7 +239972,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -232282,12 +239993,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -232318,7 +240031,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -232329,11 +240043,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -232359,7 +240074,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -232442,7 +240162,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -232477,11 +240197,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -232518,7 +240239,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -232569,7 +240291,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -232584,7 +240313,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -232763,8 +240492,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -232775,7 +240504,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -232867,13 +240596,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -233030,7 +240762,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -233047,7 +240781,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -233065,12 +240802,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -233101,7 +240840,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -233112,11 +240852,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -233142,7 +240883,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -233225,7 +240971,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -233260,11 +241006,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -233301,7 +241048,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -233352,7 +241100,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -233367,7 +241122,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -233546,8 +241301,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -233558,7 +241313,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -233650,13 +241405,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -233813,7 +241571,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -233830,7 +241590,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -233848,12 +241611,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -233884,7 +241649,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -233895,11 +241661,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -233925,7 +241692,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -234008,7 +241780,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -234043,11 +241815,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -234084,7 +241857,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -234135,7 +241909,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -234150,7 +241931,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -234329,8 +242110,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -234341,7 +242122,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -234433,13 +242214,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -234596,7 +242380,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -234613,7 +242399,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -234631,12 +242420,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -234667,7 +242458,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -234678,11 +242470,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -234708,7 +242501,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -234791,7 +242589,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -234826,11 +242624,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -234867,7 +242666,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -234918,7 +242718,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -234933,7 +242740,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -235112,8 +242919,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -235124,7 +242931,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -235216,13 +243023,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -235379,7 +243189,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -235396,7 +243208,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -235414,12 +243229,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -235450,7 +243267,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -235461,11 +243279,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -235491,7 +243310,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -235574,7 +243398,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -235609,11 +243433,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -235650,7 +243475,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -235701,7 +243527,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -235716,7 +243549,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -235895,8 +243728,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -235907,7 +243740,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -235999,13 +243832,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -236162,7 +243998,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -236179,7 +244017,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -236197,12 +244038,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -236233,7 +244076,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -236244,11 +244088,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -236274,7 +244119,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -236357,7 +244207,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -236392,11 +244242,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -236433,7 +244284,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -236484,7 +244336,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -236499,7 +244358,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -236678,8 +244537,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -236690,7 +244549,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -236782,13 +244641,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -236945,7 +244807,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -236962,7 +244826,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -236980,12 +244847,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -237016,7 +244885,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -237027,11 +244897,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -237057,7 +244928,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -237140,7 +245016,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -237175,11 +245051,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -237216,7 +245093,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -237267,7 +245145,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -237282,7 +245167,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -237461,8 +245346,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -237473,7 +245358,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -237565,13 +245450,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -237728,7 +245616,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -237745,7 +245635,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -237763,12 +245656,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -237799,7 +245694,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -237810,11 +245706,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -237840,7 +245737,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -237923,7 +245825,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -237958,11 +245860,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -237999,7 +245902,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -238050,7 +245954,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -238065,7 +245976,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -238244,8 +246155,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -238256,7 +246167,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -238348,13 +246259,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -238511,7 +246425,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -238528,7 +246444,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -238546,12 +246465,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -238582,7 +246503,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -238593,11 +246515,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -238623,7 +246546,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -238706,7 +246634,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -238741,11 +246669,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -238782,7 +246711,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -238833,7 +246763,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -238848,7 +246785,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -239027,8 +246964,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -239039,7 +246976,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -239131,13 +247068,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -239294,7 +247234,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -239311,7 +247253,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -239329,12 +247274,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -239365,7 +247312,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -239376,11 +247324,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -239406,7 +247355,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -239489,7 +247443,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -239524,11 +247478,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -239565,7 +247520,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -239616,7 +247572,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -239631,7 +247594,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -239810,8 +247773,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -239822,7 +247785,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -239914,13 +247877,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -240077,7 +248043,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -240094,7 +248062,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -240112,12 +248083,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -240148,7 +248121,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -240159,11 +248133,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -240189,7 +248164,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -240272,7 +248252,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -240307,11 +248287,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -240348,7 +248329,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -240399,7 +248381,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -240414,7 +248403,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -240593,8 +248582,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -240605,7 +248594,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -240697,13 +248686,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -240860,7 +248852,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -240877,7 +248871,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -240895,12 +248892,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -240931,7 +248930,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -240942,11 +248942,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -240972,7 +248973,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -241055,7 +249061,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -241090,11 +249096,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -241131,7 +249138,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -241182,7 +249190,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -241197,7 +249212,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -241376,8 +249391,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -241388,7 +249403,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -241480,13 +249495,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -241643,7 +249661,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -241660,7 +249680,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -241678,12 +249701,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -241714,7 +249739,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -241725,11 +249751,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -241755,7 +249782,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -241838,7 +249870,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -241873,11 +249905,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -241914,7 +249947,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -241965,7 +249999,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -241980,7 +250021,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -242159,8 +250200,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -242171,7 +250212,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -242263,13 +250304,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -242426,7 +250470,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -242443,7 +250489,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -242461,12 +250510,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -242497,7 +250548,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -242508,11 +250560,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -242538,7 +250591,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -242621,7 +250679,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -242656,11 +250714,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -242697,7 +250756,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -242748,7 +250808,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -242763,7 +250830,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -242942,8 +251009,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -242954,7 +251021,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -243046,13 +251113,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -243209,7 +251279,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -243226,7 +251298,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -243244,12 +251319,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -243280,7 +251357,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -243291,11 +251369,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -243321,7 +251400,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -243404,7 +251488,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -243439,11 +251523,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -243480,7 +251565,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -243531,7 +251617,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -243546,7 +251639,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -243725,8 +251818,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -243737,7 +251830,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -243829,13 +251922,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -243992,7 +252088,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -244009,7 +252107,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -244027,12 +252128,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -244063,7 +252166,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -244074,11 +252178,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -244104,7 +252209,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -244187,7 +252297,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -244222,11 +252332,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -244263,7 +252374,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -244314,7 +252426,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -244329,7 +252448,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -244508,8 +252627,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -244520,7 +252639,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -244612,13 +252731,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -244775,7 +252897,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -244792,7 +252916,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -244810,12 +252937,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -244846,7 +252975,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -244857,11 +252987,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -244887,7 +253018,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -244970,7 +253106,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -245005,11 +253141,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -245046,7 +253183,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -245097,7 +253235,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -245112,7 +253257,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -245291,8 +253436,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -245303,7 +253448,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -245395,13 +253540,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -245558,7 +253706,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -245575,7 +253725,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -245593,12 +253746,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -245629,7 +253784,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -245640,11 +253796,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -245670,7 +253827,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -245753,7 +253915,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -245788,11 +253950,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -245829,7 +253992,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -245880,7 +254044,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -245895,7 +254066,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -246074,8 +254245,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -246086,7 +254257,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -246178,13 +254349,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -246341,7 +254515,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -246358,7 +254534,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -246376,12 +254555,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -246412,7 +254593,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -246423,11 +254605,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -246453,7 +254636,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -246536,7 +254724,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -246571,11 +254759,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -246612,7 +254801,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -246663,7 +254853,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -246678,7 +254875,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -246857,8 +255054,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -246869,7 +255066,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -246961,13 +255158,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -247124,7 +255324,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -247141,7 +255343,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -247159,12 +255364,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -247195,7 +255402,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -247206,11 +255414,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -247236,7 +255445,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -247319,7 +255533,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -247354,11 +255568,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -247395,7 +255610,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -247446,7 +255662,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -247461,7 +255684,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -247640,8 +255863,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -247652,7 +255875,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -247744,13 +255967,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -247907,7 +256133,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -247924,7 +256152,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -247942,12 +256173,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -247978,7 +256211,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -247989,11 +256223,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -248019,7 +256254,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -248102,7 +256342,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -248137,11 +256377,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -248178,7 +256419,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -248229,7 +256471,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -248244,7 +256493,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -248423,8 +256672,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -248435,7 +256684,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -248527,13 +256776,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -248690,7 +256942,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -248707,7 +256961,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -248725,12 +256982,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -248761,7 +257020,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -248772,11 +257032,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -248802,7 +257063,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -248885,7 +257151,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -248920,11 +257186,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -248961,7 +257228,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -249012,7 +257280,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -249027,7 +257302,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -249206,8 +257481,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -249218,7 +257493,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -249310,13 +257585,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -249473,7 +257751,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -249490,7 +257770,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -249508,12 +257791,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -249544,7 +257829,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -249555,11 +257841,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -249585,7 +257872,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -249668,7 +257960,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -249703,11 +257995,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -249744,7 +258037,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -249795,7 +258089,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -249810,7 +258111,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -249989,8 +258290,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -250001,7 +258302,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -250093,13 +258394,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -250256,7 +258560,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -250273,7 +258579,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -250291,12 +258600,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -250327,7 +258638,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -250338,11 +258650,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -250368,7 +258681,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -250451,7 +258769,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -250486,11 +258804,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -250527,7 +258846,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -250578,7 +258898,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -250593,7 +258920,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -250772,8 +259099,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -250784,7 +259111,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -250876,13 +259203,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -251039,7 +259369,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -251056,7 +259388,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -251074,12 +259409,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -251110,7 +259447,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -251121,11 +259459,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -251151,7 +259490,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -251234,7 +259578,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -251269,11 +259613,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -251310,7 +259655,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -251361,7 +259707,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -251376,7 +259729,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -251555,8 +259908,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -251567,7 +259920,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -251659,13 +260012,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -251822,7 +260178,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -251839,7 +260197,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -251857,12 +260218,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -251893,7 +260256,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -251904,11 +260268,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -251934,7 +260299,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -252017,7 +260387,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -252052,11 +260422,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -252093,7 +260464,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -252144,7 +260516,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -252159,7 +260538,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -252338,8 +260717,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -252350,7 +260729,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -252442,13 +260821,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -252605,7 +260987,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -252622,7 +261006,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -252640,12 +261027,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -252676,7 +261065,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -252687,11 +261077,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -252717,7 +261108,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -252800,7 +261196,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -252835,11 +261231,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -252876,7 +261273,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -252927,7 +261325,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -252942,7 +261347,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -253121,8 +261526,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -253133,7 +261538,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -253225,13 +261630,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -253388,7 +261796,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -253405,7 +261815,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -253423,12 +261836,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -253459,7 +261874,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -253470,11 +261886,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -253500,7 +261917,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -253583,7 +262005,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -253618,11 +262040,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -253659,7 +262082,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -253710,7 +262134,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -253725,7 +262156,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -253904,8 +262335,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -253916,7 +262347,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -254008,13 +262439,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -254171,7 +262605,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -254188,7 +262624,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -254206,12 +262645,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -254242,7 +262683,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -254253,11 +262695,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -254283,7 +262726,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -254366,7 +262814,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -254401,11 +262849,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -254442,7 +262891,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -254493,7 +262943,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -254508,7 +262965,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -254687,8 +263144,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -254699,7 +263156,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -254791,13 +263248,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -254954,7 +263414,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -254971,7 +263433,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -254989,12 +263454,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -255025,7 +263492,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -255036,11 +263504,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -255066,7 +263535,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -255149,7 +263623,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -255184,11 +263658,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -255225,7 +263700,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -255276,7 +263752,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -255291,7 +263774,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -255470,8 +263953,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -255482,7 +263965,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -255574,13 +264057,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -255737,7 +264223,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -255754,7 +264242,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -255772,12 +264263,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -255808,7 +264301,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -255819,11 +264313,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -255849,7 +264344,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -255932,7 +264432,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -255967,11 +264467,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -256008,7 +264509,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -256059,7 +264561,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -256074,7 +264583,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -256253,8 +264762,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -256265,7 +264774,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -256357,13 +264866,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -256520,7 +265032,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -256537,7 +265051,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -256555,12 +265072,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -256591,7 +265110,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -256602,11 +265122,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -256632,7 +265153,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -256715,7 +265241,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -256750,11 +265276,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -256791,7 +265318,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -256842,7 +265370,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -256857,7 +265392,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -257036,8 +265571,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -257048,7 +265583,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -257140,13 +265675,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -257303,7 +265841,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -257320,7 +265860,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -257338,12 +265881,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -257374,7 +265919,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -257385,11 +265931,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -257415,7 +265962,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -257498,7 +266050,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -257533,11 +266085,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -257574,7 +266127,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -257625,7 +266179,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -257640,7 +266201,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -257819,8 +266380,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -257831,7 +266392,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -257923,13 +266484,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -258086,7 +266650,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -258103,7 +266669,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -258121,12 +266690,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -258157,7 +266728,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -258168,11 +266740,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -258198,7 +266771,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -258281,7 +266859,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -258316,11 +266894,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -258357,7 +266936,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -258408,7 +266988,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -258423,7 +267010,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -258602,8 +267189,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -258614,7 +267201,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -258706,13 +267293,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -258869,7 +267459,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -258886,7 +267478,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -258904,12 +267499,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -258940,7 +267537,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -258951,11 +267549,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -258981,7 +267580,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -259064,7 +267668,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -259099,11 +267703,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -259140,7 +267745,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -259191,7 +267797,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -259206,7 +267819,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -259385,8 +267998,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -259397,7 +268010,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -259489,13 +268102,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -259652,7 +268268,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -259669,7 +268287,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -259687,12 +268308,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -259723,7 +268346,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -259734,11 +268358,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -259764,7 +268389,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -259847,7 +268477,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -259882,11 +268512,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -259923,7 +268554,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -259974,7 +268606,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -259989,7 +268628,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -260168,8 +268807,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -260180,7 +268819,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -260272,13 +268911,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -260435,7 +269077,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -260452,7 +269096,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -260470,12 +269117,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -260506,7 +269155,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -260517,11 +269167,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -260547,7 +269198,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -260630,7 +269286,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -260665,11 +269321,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -260706,7 +269363,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -260757,7 +269415,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -260772,7 +269437,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -260951,8 +269616,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -260963,7 +269628,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -261055,13 +269720,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -261218,7 +269886,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -261235,7 +269905,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -261253,12 +269926,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -261289,7 +269964,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -261300,11 +269976,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -261330,7 +270007,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -261413,7 +270095,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -261448,11 +270130,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -261489,7 +270172,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -261540,7 +270224,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -261555,7 +270246,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -261734,8 +270425,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -261746,7 +270437,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -261838,13 +270529,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -262001,7 +270695,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -262018,7 +270714,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -262036,12 +270735,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -262072,7 +270773,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -262083,11 +270785,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -262113,7 +270816,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -262196,7 +270904,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -262231,11 +270939,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -262272,7 +270981,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -262323,7 +271033,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -262338,7 +271055,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -262517,8 +271234,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -262529,7 +271246,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -262621,13 +271338,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -262784,7 +271504,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -262801,7 +271523,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -262819,12 +271544,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -262855,7 +271582,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -262866,11 +271594,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -262896,7 +271625,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -262979,7 +271713,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -263014,11 +271748,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -263055,7 +271790,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -263106,7 +271842,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -263121,7 +271864,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -263300,8 +272043,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -263312,7 +272055,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -263404,13 +272147,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -263567,7 +272313,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -263584,7 +272332,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -263602,12 +272353,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -263638,7 +272391,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -263649,11 +272403,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -263679,7 +272434,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -263762,7 +272522,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -263797,11 +272557,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -263838,7 +272599,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -263889,7 +272651,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -263904,7 +272673,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -264083,8 +272852,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -264095,7 +272864,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -264187,13 +272956,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -264350,7 +273122,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -264367,7 +273141,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -264385,12 +273162,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -264421,7 +273200,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -264432,11 +273212,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -264462,7 +273243,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -264545,7 +273331,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -264580,11 +273366,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -264621,7 +273408,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -264672,7 +273460,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -264687,7 +273482,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -264866,8 +273661,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -264878,7 +273673,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -264970,13 +273765,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -265133,7 +273931,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -265150,7 +273950,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -265168,12 +273971,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -265204,7 +274009,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -265215,11 +274021,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -265245,7 +274052,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -265328,7 +274140,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -265363,11 +274175,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -265404,7 +274217,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -265455,7 +274269,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -265470,7 +274291,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -265649,8 +274470,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -265661,7 +274482,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -265753,13 +274574,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -265916,7 +274740,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -265933,7 +274759,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -265951,12 +274780,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -265987,7 +274818,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -265998,11 +274830,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -266028,7 +274861,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -266111,7 +274949,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -266146,11 +274984,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -266187,7 +275026,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -266238,7 +275078,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -266253,7 +275100,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -266432,8 +275279,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -266444,7 +275291,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -266536,13 +275383,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -266699,7 +275549,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -266716,7 +275568,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -266734,12 +275589,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -266770,7 +275627,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -266781,11 +275639,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -266811,7 +275670,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -266894,7 +275758,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -266929,11 +275793,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -266970,7 +275835,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -267021,7 +275887,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -267036,7 +275909,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -267215,8 +276088,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -267227,7 +276100,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -267319,13 +276192,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -267482,7 +276358,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -267499,7 +276377,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -267517,12 +276398,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -267553,7 +276436,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -267564,11 +276448,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -267594,7 +276479,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -267677,7 +276567,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -267712,11 +276602,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -267753,7 +276644,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -267804,7 +276696,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -267819,7 +276718,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -267998,8 +276897,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -268010,7 +276909,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -268102,13 +277001,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -268265,7 +277167,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -268282,7 +277186,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -268300,12 +277207,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -268336,7 +277245,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -268347,11 +277257,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -268377,7 +277288,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -268460,7 +277376,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -268495,11 +277411,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -268536,7 +277453,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -268587,7 +277505,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -268602,7 +277527,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -268781,8 +277706,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -268793,7 +277718,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -268885,13 +277810,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -269048,7 +277976,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -269065,7 +277995,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -269083,12 +278016,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -269119,7 +278054,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -269130,11 +278066,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -269160,7 +278097,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -269243,7 +278185,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -269278,11 +278220,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -269319,7 +278262,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -269370,7 +278314,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -269385,7 +278336,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -269564,8 +278515,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -269576,7 +278527,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -269668,13 +278619,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -269831,7 +278785,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -269848,7 +278804,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -269866,12 +278825,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -269902,7 +278863,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -269913,11 +278875,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -269943,7 +278906,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -270026,7 +278994,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -270061,11 +279029,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -270102,7 +279071,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -270153,7 +279123,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -270168,7 +279145,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -270347,8 +279324,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -270359,7 +279336,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -270451,13 +279428,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -270614,7 +279594,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -270631,7 +279613,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -270649,12 +279634,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -270685,7 +279672,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -270696,11 +279684,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -270726,7 +279715,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -270809,7 +279803,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -270844,11 +279838,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -270885,7 +279880,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -270936,7 +279932,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -270951,7 +279954,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -271130,8 +280133,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -271142,7 +280145,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -271234,13 +280237,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -271397,7 +280403,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -271414,7 +280422,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -271432,12 +280443,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -271468,7 +280481,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -271479,11 +280493,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -271509,7 +280524,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -271592,7 +280612,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -271627,11 +280647,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -271668,7 +280689,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -271719,7 +280741,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -271734,7 +280763,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -271913,8 +280942,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -271925,7 +280954,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -272017,13 +281046,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -272180,7 +281212,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -272197,7 +281231,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -272215,12 +281252,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -272251,7 +281290,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -272262,11 +281302,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -272292,7 +281333,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -272375,7 +281421,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -272410,11 +281456,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -272451,7 +281498,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -272502,7 +281550,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -272517,7 +281572,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -272696,8 +281751,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -272708,7 +281763,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -272800,13 +281855,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -272963,7 +282021,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -272980,7 +282040,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -272998,12 +282061,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -273034,7 +282099,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -273045,11 +282111,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -273075,7 +282142,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -273158,7 +282230,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -273193,11 +282265,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -273234,7 +282307,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -273285,7 +282359,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -273300,7 +282381,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -273479,8 +282560,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -273491,7 +282572,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -273583,13 +282664,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -273746,7 +282830,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -273763,7 +282849,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -273781,12 +282870,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -273817,7 +282908,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -273828,11 +282920,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -273858,7 +282951,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -273941,7 +283039,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -273976,11 +283074,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -274017,7 +283116,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -274068,7 +283168,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -274083,7 +283190,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -274262,8 +283369,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -274274,7 +283381,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -274366,13 +283473,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -274529,7 +283639,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -274546,7 +283658,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -274564,12 +283679,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -274600,7 +283717,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -274611,11 +283729,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -274641,7 +283760,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -274724,7 +283848,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -274759,11 +283883,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -274800,7 +283925,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 @@ -274851,7 +283977,14 @@ T1037,No,-,0 T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 T1033,No,-,0 T1583,No,-,0 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,1 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,8 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,8 T1143,No,-,0 T1161,No,-,0 T1132.001,No,-,0 @@ -274866,7 +283999,7 @@ T1222.002,No,-,0 T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,14 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,18 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -275045,8 +284178,8 @@ T1583.001,No,-,0 T1560.002,No,-,0 T1055.003,No,-,0 T1079,No,-,0 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,7 -T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,7 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,8 +T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,8 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,3 T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,3 @@ -275057,7 +284190,7 @@ T1055,No,-,0 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 -T1218,No,-,7 +T1218,No,-,26 T1153,No,-,0 T1038,No,-,0 T1050,No,-,0 @@ -275149,13 +284282,16 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,7 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,7 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 T1053.001,No,-,0 T1179,No,-,0 T1595,No,-,0 @@ -275312,7 +284448,9 @@ T1169,No,-,0 T1574.010,No,-,0 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,1 T1199,No,-,0 -T1136.003,No,-,0 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml,3 +T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml,3 T1069.001,No,-,0 T1149,No,-,0 T1593,No,-,0 @@ -275329,7 +284467,10 @@ T1053.006,No,-,0 T1566,No,-,2 T1061,No,-,0 T1542.004,No,-,0 -T1218.001,No,-,0 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,4 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 @@ -275347,12 +284488,14 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,No,-,2 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,30 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,30 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,32 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,32 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -275383,7 +284526,8 @@ T1592.003,No,-,0 T1573,No,-,0 T1174,No,-,0 T1547.002,No,-,0 -T1218.010,No,-,0 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,2 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,2 T1002,No,-,0 T1081,No,-,0 T1592.002,No,-,0 @@ -275394,11 +284538,12 @@ T1593.001,No,-,0 T1546.015,No,-,0 T1589.001,No,-,0 T1195.002,No,-,0 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,5 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,5 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,2 T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,2 @@ -275424,7 +284569,12 @@ T1028,No,-,0 T1550.004,No,-,0 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,2 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,2 -T1218.009,No,-,0 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml,6 +T1218.009,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml,6 T1034,No,-,0 T1506,No,-,0 T1553.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_add_certificate_to_untrusted_store.yml,1 @@ -275507,7 +284657,7 @@ T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 -T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,4 +T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 T1526,No,-,0 T1151,No,-,0 @@ -275542,11 +284692,12 @@ T1591.001,No,-,0 T1137.002,No,-,0 T1587,No,-,0 T1173,No,-,0 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,5 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,5 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,6 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,6 T1602.001,No,-,0 T1001.002,No,-,0 T1204.001,No,-,0 @@ -275583,7 +284734,8 @@ T1035,No,-,0 T1055.001,No,-,0 T1086,No,-,0 T1588.005,No,-,0 -T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,1 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml,2 +T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml,2 T1056.004,No,-,0 T1495,No,-,0 T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,3 diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index d60282d157..ebe06f9689 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -31,8 +31,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -54,7 +54,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -288,7 +288,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -416,8 +416,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -625,6 +625,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -641,8 +646,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -672,8 +680,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -718,7 +726,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -731,8 +743,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -773,7 +785,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -880,7 +896,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -933,8 +949,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -965,8 +981,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -1041,8 +1057,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -1064,7 +1080,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -1298,7 +1314,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -1426,8 +1442,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -1635,6 +1651,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -1651,8 +1672,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -1682,8 +1706,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -1728,7 +1752,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -1741,8 +1769,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -1783,7 +1811,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -1890,7 +1922,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -1943,8 +1975,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -1975,8 +2007,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -2051,8 +2083,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -2074,7 +2106,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -2308,7 +2340,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -2436,8 +2468,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -2645,6 +2677,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -2661,8 +2698,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -2692,8 +2732,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -2738,7 +2778,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -2751,8 +2795,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -2793,7 +2837,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -2900,7 +2948,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -2953,8 +3001,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -2985,8 +3033,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -3061,8 +3109,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -3084,7 +3132,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -3318,7 +3366,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -3446,8 +3494,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -3655,8 +3703,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -3673,6 +3724,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -3702,8 +3758,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -3748,7 +3804,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -3761,8 +3821,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -3803,7 +3863,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -3910,7 +3974,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -3963,8 +4027,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -3995,8 +4059,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -4071,8 +4135,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -4094,7 +4158,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -4328,7 +4392,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -4456,8 +4520,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -4665,6 +4729,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -4681,8 +4750,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -4712,8 +4784,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -4758,7 +4830,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -4771,8 +4847,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -4813,7 +4889,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -4920,7 +5000,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -4973,8 +5053,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -5005,8 +5085,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -5081,8 +5161,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -5104,7 +5184,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -5338,7 +5418,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -5466,8 +5546,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -5675,6 +5755,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -5691,8 +5776,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -5722,8 +5810,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -5768,7 +5856,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -5781,8 +5873,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -5823,7 +5915,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -5930,7 +6026,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -5983,8 +6079,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -6015,8 +6111,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -6091,8 +6187,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -6114,7 +6210,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -6348,7 +6444,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -6476,8 +6572,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -6685,6 +6781,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -6701,8 +6802,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -6732,8 +6836,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -6778,7 +6882,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -6791,8 +6899,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -6833,7 +6941,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -6940,7 +7052,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -6993,8 +7105,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -7025,8 +7137,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -7101,8 +7213,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -7124,7 +7236,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -7358,7 +7470,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -7486,8 +7598,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -7695,8 +7807,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -7713,6 +7828,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -7742,8 +7862,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -7788,7 +7908,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -7801,8 +7925,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -7843,7 +7967,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -7950,7 +8078,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -8003,8 +8131,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -8035,8 +8163,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -8111,8 +8239,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -8134,7 +8262,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -8368,7 +8496,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -8496,8 +8624,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -8705,6 +8833,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -8721,8 +8854,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -8752,8 +8888,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -8798,7 +8934,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -8811,8 +8951,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -8853,7 +8993,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -8960,7 +9104,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -9013,8 +9157,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -9045,8 +9189,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -9121,8 +9265,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -9144,7 +9288,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -9378,7 +9522,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -9506,8 +9650,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -9715,6 +9859,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -9731,8 +9880,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -9762,8 +9914,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -9808,7 +9960,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -9821,8 +9977,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -9863,7 +10019,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -9970,7 +10130,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -10023,8 +10183,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -10055,8 +10215,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -10131,8 +10291,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -10154,7 +10314,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -10388,7 +10548,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -10516,8 +10676,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -10725,6 +10885,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -10741,8 +10906,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -10772,8 +10940,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -10818,7 +10986,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -10831,8 +11003,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -10873,7 +11045,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -10980,7 +11156,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -11033,8 +11209,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -11065,8 +11241,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -11141,8 +11317,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -11164,7 +11340,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -11398,7 +11574,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -11526,8 +11702,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -11735,8 +11911,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -11753,6 +11932,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -11782,8 +11966,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -11828,7 +12012,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -11841,8 +12029,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -11883,7 +12071,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -11990,7 +12182,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -12043,8 +12235,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -12075,8 +12267,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -12151,8 +12343,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -12174,7 +12366,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -12408,7 +12600,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -12536,8 +12728,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -12745,6 +12937,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -12761,8 +12958,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -12792,8 +12992,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -12838,7 +13038,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -12851,8 +13055,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -12893,7 +13097,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -13000,7 +13208,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -13053,8 +13261,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -13085,8 +13293,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -13161,8 +13369,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -13184,7 +13392,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -13418,7 +13626,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -13546,8 +13754,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -13755,8 +13963,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -13773,6 +13984,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -13802,8 +14018,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -13848,7 +14064,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -13861,8 +14081,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -13903,7 +14123,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -14010,7 +14234,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -14063,8 +14287,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -14095,8 +14319,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -14171,8 +14395,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -14194,7 +14418,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -14428,7 +14652,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -14556,8 +14780,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -14765,8 +14989,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -14783,6 +15010,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -14812,8 +15044,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -14858,7 +15090,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -14871,8 +15107,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -14913,7 +15149,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -15020,7 +15260,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -15073,8 +15313,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -15105,8 +15345,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -15181,8 +15421,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -15204,7 +15444,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -15438,7 +15678,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -15566,8 +15806,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -15775,6 +16015,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -15791,8 +16036,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -15822,8 +16070,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -15868,7 +16116,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -15881,8 +16133,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -15923,7 +16175,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -16030,7 +16286,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -16083,8 +16339,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -16115,8 +16371,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -16191,8 +16447,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -16214,7 +16470,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -16448,7 +16704,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -16576,8 +16832,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -16785,6 +17041,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -16801,8 +17062,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -16832,8 +17096,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -16878,7 +17142,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -16891,8 +17159,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -16933,7 +17201,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -17040,7 +17312,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -17093,8 +17365,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -17125,8 +17397,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -17201,8 +17473,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -17224,7 +17496,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -17458,7 +17730,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -17586,8 +17858,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -17795,6 +18067,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -17811,8 +18088,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -17842,8 +18122,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -17888,7 +18168,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -17901,8 +18185,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -17943,7 +18227,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -18050,7 +18338,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -18103,8 +18391,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -18135,8 +18423,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -18211,8 +18499,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -18234,7 +18522,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -18468,7 +18756,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -18596,8 +18884,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -18805,8 +19093,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -18823,6 +19114,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -18852,8 +19148,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -18898,7 +19194,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -18911,8 +19211,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -18953,7 +19253,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -19060,7 +19364,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -19113,8 +19417,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -19145,8 +19449,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -19221,8 +19525,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -19244,7 +19548,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -19478,7 +19782,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -19606,8 +19910,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -19815,8 +20119,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -19833,6 +20140,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -19862,8 +20174,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -19908,7 +20220,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -19921,8 +20237,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -19963,7 +20279,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -20070,7 +20390,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -20123,8 +20443,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -20155,8 +20475,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -20231,8 +20551,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -20254,7 +20574,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -20488,7 +20808,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -20616,8 +20936,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -20825,6 +21145,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -20841,8 +21166,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -20872,8 +21200,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -20918,7 +21246,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -20931,8 +21263,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -20973,7 +21305,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -21080,7 +21416,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -21133,8 +21469,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -21165,8 +21501,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -21241,8 +21577,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -21264,7 +21600,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -21498,7 +21834,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -21626,8 +21962,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -21835,6 +22171,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -21851,8 +22192,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -21882,8 +22226,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -21928,7 +22272,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -21941,8 +22289,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -21983,7 +22331,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -22090,7 +22442,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -22143,8 +22495,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -22175,8 +22527,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -22251,8 +22603,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -22274,7 +22626,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -22508,7 +22860,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -22636,8 +22988,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -22845,6 +23197,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -22861,8 +23218,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -22892,8 +23252,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -22938,7 +23298,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -22951,8 +23315,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -22993,7 +23357,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -23100,7 +23468,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -23153,8 +23521,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -23185,8 +23553,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -23261,8 +23629,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -23284,7 +23652,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -23518,7 +23886,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -23646,8 +24014,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -23855,8 +24223,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -23873,6 +24244,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -23902,8 +24278,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -23948,7 +24324,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -23961,8 +24341,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -24003,7 +24383,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -24110,7 +24494,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -24163,8 +24547,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -24195,8 +24579,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -24271,8 +24655,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -24294,7 +24678,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -24528,7 +24912,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -24656,8 +25040,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -24865,6 +25249,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -24881,8 +25270,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -24912,8 +25304,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -24958,7 +25350,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -24971,8 +25367,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -25013,7 +25409,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -25120,7 +25520,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -25173,8 +25573,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -25205,8 +25605,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -25281,8 +25681,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -25304,7 +25704,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -25538,7 +25938,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -25666,8 +26066,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -25875,6 +26275,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -25891,8 +26296,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -25922,8 +26330,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -25968,7 +26376,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -25981,8 +26393,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -26023,7 +26435,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -26130,7 +26546,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -26183,8 +26599,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -26215,8 +26631,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -26291,8 +26707,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -26314,7 +26730,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -26548,7 +26964,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -26676,8 +27092,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -26885,6 +27301,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -26901,8 +27322,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -26932,8 +27356,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -26978,7 +27402,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -26991,8 +27419,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -27033,7 +27461,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -27140,7 +27572,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -27193,8 +27625,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -27225,8 +27657,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -27301,8 +27733,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -27324,7 +27756,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -27558,7 +27990,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -27686,8 +28118,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -27895,6 +28327,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -27911,8 +28348,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -27942,8 +28382,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -27988,7 +28428,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -28001,8 +28445,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -28043,7 +28487,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -28150,7 +28598,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -28203,8 +28651,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -28235,8 +28683,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -28311,8 +28759,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -28334,7 +28782,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -28568,7 +29016,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -28696,8 +29144,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -28905,8 +29353,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -28923,6 +29374,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -28952,8 +29408,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -28998,7 +29454,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -29011,8 +29471,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -29053,7 +29513,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -29160,7 +29624,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -29213,8 +29677,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -29245,8 +29709,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -29321,8 +29785,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -29344,7 +29808,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -29578,7 +30042,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -29706,8 +30170,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -29915,6 +30379,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -29931,8 +30400,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -29962,8 +30434,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -30008,7 +30480,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -30021,8 +30497,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -30063,7 +30539,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -30170,7 +30650,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -30223,8 +30703,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -30255,8 +30735,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -30331,8 +30811,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -30354,7 +30834,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -30588,7 +31068,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -30716,8 +31196,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -30925,8 +31405,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -30943,6 +31426,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -30972,8 +31460,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -31018,7 +31506,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -31031,8 +31523,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -31073,7 +31565,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -31180,7 +31676,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -31233,8 +31729,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -31265,8 +31761,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -31341,8 +31837,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -31364,7 +31860,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -31598,7 +32094,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -31726,8 +32222,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -31935,8 +32431,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -31953,6 +32452,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -31982,8 +32486,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -32028,7 +32532,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -32041,8 +32549,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -32083,7 +32591,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -32190,7 +32702,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -32243,8 +32755,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -32275,8 +32787,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -32351,8 +32863,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -32374,7 +32886,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -32608,7 +33120,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -32736,8 +33248,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -32945,6 +33457,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -32961,8 +33478,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -32992,8 +33512,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -33038,7 +33558,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -33051,8 +33575,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -33093,7 +33617,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -33200,7 +33728,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -33253,8 +33781,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -33285,8 +33813,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -33361,8 +33889,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -33384,7 +33912,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -33618,7 +34146,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -33746,8 +34274,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -33955,6 +34483,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -33971,8 +34504,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -34002,8 +34538,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -34048,7 +34584,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -34061,8 +34601,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -34103,7 +34643,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -34210,7 +34754,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -34263,8 +34807,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -34295,8 +34839,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -34371,8 +34915,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -34394,7 +34938,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -34628,7 +35172,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -34756,8 +35300,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -34965,6 +35509,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -34981,8 +35530,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -35012,8 +35564,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -35058,7 +35610,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -35071,8 +35627,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -35113,7 +35669,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -35220,7 +35780,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -35273,8 +35833,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -35305,8 +35865,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -35381,8 +35941,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -35404,7 +35964,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -35638,7 +36198,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -35766,8 +36326,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -35975,6 +36535,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -35991,8 +36556,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -36022,8 +36590,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -36068,7 +36636,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -36081,8 +36653,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -36123,7 +36695,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -36230,7 +36806,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -36283,8 +36859,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -36315,8 +36891,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -36391,8 +36967,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -36414,7 +36990,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -36648,7 +37224,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -36776,8 +37352,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -36985,6 +37561,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -37001,8 +37582,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -37032,8 +37616,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -37078,7 +37662,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -37091,8 +37679,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -37133,7 +37721,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -37240,7 +37832,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -37293,8 +37885,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -37325,8 +37917,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -37401,8 +37993,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -37424,7 +38016,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -37658,7 +38250,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -37786,8 +38378,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -37995,8 +38587,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -38013,6 +38608,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -38042,8 +38642,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -38088,7 +38688,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -38101,8 +38705,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -38143,7 +38747,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -38250,7 +38858,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -38303,8 +38911,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -38335,8 +38943,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -38411,8 +39019,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -38434,7 +39042,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -38668,7 +39276,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -38796,8 +39404,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -39005,6 +39613,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -39021,8 +39634,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -39052,8 +39668,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -39098,7 +39714,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -39111,8 +39731,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -39153,7 +39773,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -39260,7 +39884,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -39313,8 +39937,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -39345,8 +39969,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -39421,8 +40045,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -39444,7 +40068,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -39678,7 +40302,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -39806,8 +40430,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -40015,8 +40639,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -40033,6 +40660,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -40062,8 +40694,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -40108,7 +40740,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -40121,8 +40757,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -40163,7 +40799,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -40270,7 +40910,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -40323,8 +40963,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -40355,8 +40995,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -40431,8 +41071,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -40454,7 +41094,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -40688,7 +41328,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -40816,8 +41456,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -41025,8 +41665,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -41043,6 +41686,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -41072,8 +41720,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -41118,7 +41766,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -41131,8 +41783,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -41173,7 +41825,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -41280,7 +41936,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -41333,8 +41989,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -41365,8 +42021,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -41441,8 +42097,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -41464,7 +42120,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -41698,7 +42354,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -41826,8 +42482,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -42035,6 +42691,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -42051,8 +42712,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -42082,8 +42746,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -42128,7 +42792,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -42141,8 +42809,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -42183,7 +42851,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -42290,7 +42962,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -42343,8 +43015,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -42375,8 +43047,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -42451,8 +43123,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -42474,7 +43146,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -42708,7 +43380,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -42836,8 +43508,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -43045,6 +43717,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -43061,8 +43738,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -43092,8 +43772,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -43138,7 +43818,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -43151,8 +43835,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -43193,7 +43877,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -43300,7 +43988,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -43353,8 +44041,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -43385,8 +44073,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -43461,8 +44149,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -43484,7 +44172,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -43718,7 +44406,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -43846,8 +44534,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -44055,6 +44743,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -44071,8 +44764,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -44102,8 +44798,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -44148,7 +44844,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -44161,8 +44861,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -44203,7 +44903,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -44310,7 +45014,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -44363,8 +45067,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -44395,8 +45099,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -44471,8 +45175,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -44494,7 +45198,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -44728,7 +45432,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -44856,8 +45560,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -45065,6 +45769,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -45081,8 +45790,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -45112,8 +45824,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -45158,7 +45870,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -45171,8 +45887,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -45213,7 +45929,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -45320,7 +46040,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -45373,8 +46093,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -45405,8 +46125,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -45481,8 +46201,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -45504,7 +46224,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -45738,7 +46458,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -45866,8 +46586,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -46075,6 +46795,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -46091,8 +46816,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -46122,8 +46850,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -46168,7 +46896,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -46181,8 +46913,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -46223,7 +46955,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -46330,7 +47066,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -46383,8 +47119,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -46415,8 +47151,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -46491,8 +47227,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -46514,7 +47250,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -46748,7 +47484,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -46876,8 +47612,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -47085,8 +47821,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -47103,6 +47842,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -47132,8 +47876,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -47178,7 +47922,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -47191,8 +47939,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -47233,7 +47981,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -47340,7 +48092,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -47393,8 +48145,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -47425,8 +48177,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -47501,8 +48253,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -47524,7 +48276,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -47758,7 +48510,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -47886,8 +48638,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -48095,6 +48847,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -48111,8 +48868,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -48142,8 +48902,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -48188,7 +48948,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -48201,8 +48965,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -48243,7 +49007,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -48350,7 +49118,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -48403,8 +49171,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -48435,8 +49203,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -48511,8 +49279,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -48534,7 +49302,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -48768,7 +49536,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -48896,8 +49664,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -49105,8 +49873,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -49123,6 +49894,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -49152,8 +49928,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -49198,7 +49974,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -49211,8 +49991,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -49253,7 +50033,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -49360,7 +50144,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -49413,8 +50197,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -49445,8 +50229,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -49521,8 +50305,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -49544,7 +50328,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -49778,7 +50562,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -49906,8 +50690,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -50115,8 +50899,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -50133,6 +50920,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -50162,8 +50954,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -50208,7 +51000,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -50221,8 +51017,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -50263,7 +51059,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -50370,7 +51170,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -50423,8 +51223,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -50455,8 +51255,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -50531,8 +51331,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -50554,7 +51354,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -50788,7 +51588,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -50916,8 +51716,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -51125,6 +51925,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -51141,8 +51946,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -51172,8 +51980,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -51218,7 +52026,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -51231,8 +52043,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -51273,7 +52085,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -51380,7 +52196,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -51433,8 +52249,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -51465,8 +52281,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -51541,8 +52357,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -51564,7 +52380,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -51798,7 +52614,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -51926,8 +52742,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -52135,6 +52951,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -52151,8 +52972,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -52182,8 +53006,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -52228,7 +53052,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -52241,8 +53069,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -52283,7 +53111,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -52390,7 +53222,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -52443,8 +53275,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -52475,8 +53307,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -52551,8 +53383,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -52574,7 +53406,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -52808,7 +53640,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -52936,8 +53768,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -53145,6 +53977,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -53161,8 +53998,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -53192,8 +54032,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -53238,7 +54078,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -53251,8 +54095,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -53293,7 +54137,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -53400,7 +54248,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -53453,8 +54301,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -53485,8 +54333,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -53561,8 +54409,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -53584,7 +54432,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -53818,7 +54666,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -53946,8 +54794,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -54155,6 +55003,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -54171,8 +55024,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -54202,8 +55058,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -54248,7 +55104,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -54261,8 +55121,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -54303,7 +55163,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -54410,7 +55274,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -54463,8 +55327,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -54495,8 +55359,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -54571,8 +55435,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -54594,7 +55458,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -54828,7 +55692,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -54956,8 +55820,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -55165,6 +56029,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -55181,8 +56050,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -55212,8 +56084,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -55258,7 +56130,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -55271,8 +56147,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -55313,7 +56189,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -55420,7 +56300,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -55473,8 +56353,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -55505,8 +56385,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -55581,8 +56461,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -55604,7 +56484,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -55838,7 +56718,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -55966,8 +56846,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -56175,8 +57055,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -56193,6 +57076,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -56222,8 +57110,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -56268,7 +57156,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -56281,8 +57173,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -56323,7 +57215,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -56430,7 +57326,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -56483,8 +57379,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -56515,8 +57411,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -56591,8 +57487,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -56614,7 +57510,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -56848,7 +57744,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -56976,8 +57872,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -57185,6 +58081,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -57201,8 +58102,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -57232,8 +58136,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -57278,7 +58182,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -57291,8 +58199,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -57333,7 +58241,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -57440,7 +58352,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -57493,8 +58405,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -57525,8 +58437,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -57601,8 +58513,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -57624,7 +58536,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -57858,7 +58770,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -57986,8 +58898,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -58195,8 +59107,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -58213,6 +59128,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -58242,8 +59162,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -58288,7 +59208,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -58301,8 +59225,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -58343,7 +59267,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -58450,7 +59378,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -58503,8 +59431,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -58535,8 +59463,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -58611,8 +59539,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -58634,7 +59562,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -58868,7 +59796,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -58996,8 +59924,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -59205,8 +60133,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -59223,6 +60154,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -59252,8 +60188,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -59298,7 +60234,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -59311,8 +60251,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -59353,7 +60293,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -59460,7 +60404,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -59513,8 +60457,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -59545,8 +60489,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -59621,8 +60565,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -59644,7 +60588,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -59878,7 +60822,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -60006,8 +60950,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -60215,6 +61159,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -60231,8 +61180,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -60262,8 +61214,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -60308,7 +61260,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -60321,8 +61277,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -60363,7 +61319,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -60470,7 +61430,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -60523,8 +61483,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -60555,8 +61515,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -60631,8 +61591,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -60654,7 +61614,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -60888,7 +61848,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -61016,8 +61976,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -61225,6 +62185,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -61241,8 +62206,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -61272,8 +62240,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -61318,7 +62286,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -61331,8 +62303,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -61373,7 +62345,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -61480,7 +62456,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -61533,8 +62509,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -61565,8 +62541,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -61641,8 +62617,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -61664,7 +62640,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -61898,7 +62874,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -62026,8 +63002,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -62235,6 +63211,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -62251,8 +63232,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -62282,8 +63266,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -62328,7 +63312,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -62341,8 +63329,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -62383,7 +63371,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -62490,7 +63482,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -62543,8 +63535,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -62575,8 +63567,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -62651,8 +63643,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -62674,7 +63666,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -62908,7 +63900,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -63036,8 +64028,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -63245,6 +64237,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -63261,8 +64258,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -63292,8 +64292,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -63338,7 +64338,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -63351,8 +64355,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -63393,7 +64397,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -63500,7 +64508,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -63553,8 +64561,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -63585,8 +64593,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -63661,8 +64669,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -63684,7 +64692,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -63918,7 +64926,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -64046,8 +65054,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -64255,6 +65263,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -64271,8 +65284,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -64302,8 +65318,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -64348,7 +65364,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -64361,8 +65381,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -64403,7 +65423,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -64510,7 +65534,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -64563,8 +65587,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -64595,8 +65619,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -64671,8 +65695,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -64694,7 +65718,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -64928,7 +65952,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -65056,8 +66080,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -65265,8 +66289,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -65283,6 +66310,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -65312,8 +66344,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -65358,7 +66390,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -65371,8 +66407,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -65413,7 +66449,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -65520,7 +66560,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -65573,8 +66613,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -65605,8 +66645,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -65681,8 +66721,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -65704,7 +66744,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -65938,7 +66978,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -66066,8 +67106,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -66275,6 +67315,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -66291,8 +67336,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -66322,8 +67370,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -66368,7 +67416,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -66381,8 +67433,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -66423,7 +67475,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -66530,7 +67586,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -66583,8 +67639,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -66615,8 +67671,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -66691,8 +67747,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -66714,7 +67770,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -66948,7 +68004,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -67076,8 +68132,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -67285,8 +68341,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -67303,6 +68362,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -67332,8 +68396,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -67378,7 +68442,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -67391,8 +68459,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -67433,7 +68501,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -67540,7 +68612,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -67593,8 +68665,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -67625,8 +68697,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -67701,8 +68773,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -67724,7 +68796,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -67958,7 +69030,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -68086,8 +69158,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -68295,8 +69367,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -68313,6 +69388,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -68342,8 +69422,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -68388,7 +69468,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -68401,8 +69485,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -68443,7 +69527,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -68550,7 +69638,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -68603,8 +69691,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -68635,8 +69723,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -68711,8 +69799,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -68734,7 +69822,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -68968,7 +70056,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -69096,8 +70184,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -69305,6 +70393,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -69321,8 +70414,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -69352,8 +70448,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -69398,7 +70494,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -69411,8 +70511,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -69453,7 +70553,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -69560,7 +70664,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -69613,8 +70717,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -69645,8 +70749,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -69721,8 +70825,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -69744,7 +70848,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -69978,7 +71082,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -70106,8 +71210,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -70315,6 +71419,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -70331,8 +71440,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -70362,8 +71474,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -70408,7 +71520,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -70421,8 +71537,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -70463,7 +71579,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -70570,7 +71690,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -70623,8 +71743,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -70655,8 +71775,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -70731,8 +71851,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -70754,7 +71874,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -70988,7 +72108,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -71116,8 +72236,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -71325,6 +72445,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -71341,8 +72466,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -71372,8 +72500,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -71418,7 +72546,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -71431,8 +72563,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -71473,7 +72605,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -71580,7 +72716,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -71633,8 +72769,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -71665,8 +72801,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -71741,8 +72877,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -71764,7 +72900,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -71998,7 +73134,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -72126,8 +73262,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -72335,6 +73471,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -72351,8 +73492,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -72382,8 +73526,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -72428,7 +73572,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -72441,8 +73589,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -72483,7 +73631,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -72590,7 +73742,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -72643,8 +73795,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -72675,8 +73827,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -72751,8 +73903,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -72774,7 +73926,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -73008,7 +74160,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -73136,8 +74288,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -73345,6 +74497,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -73361,8 +74518,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -73392,8 +74552,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -73438,7 +74598,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -73451,8 +74615,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -73493,7 +74657,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -73600,7 +74768,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -73653,8 +74821,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -73685,8 +74853,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -73761,8 +74929,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -73784,7 +74952,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -74018,7 +75186,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -74146,8 +75314,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -74355,8 +75523,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -74373,6 +75544,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -74402,8 +75578,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -74448,7 +75624,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -74461,8 +75641,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -74503,7 +75683,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -74610,7 +75794,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -74663,8 +75847,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -74695,8 +75879,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -74771,8 +75955,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -74794,7 +75978,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -75028,7 +76212,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -75156,8 +76340,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -75365,6 +76549,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -75381,8 +76570,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -75412,8 +76604,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -75458,7 +76650,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -75471,8 +76667,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -75513,7 +76709,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -75620,7 +76820,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -75673,8 +76873,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -75705,8 +76905,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -75781,8 +76981,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -75804,7 +77004,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -76038,7 +77238,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -76166,8 +77366,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -76375,8 +77575,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -76393,6 +77596,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -76422,8 +77630,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -76468,7 +77676,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -76481,8 +77693,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -76523,7 +77735,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -76630,7 +77846,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -76683,8 +77899,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -76715,8 +77931,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -76791,8 +78007,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -76814,7 +78030,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -77048,7 +78264,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -77176,8 +78392,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -77385,8 +78601,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -77403,6 +78622,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -77432,8 +78656,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -77478,7 +78702,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -77491,8 +78719,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -77533,7 +78761,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -77640,7 +78872,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -77693,8 +78925,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -77725,8 +78957,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -77801,8 +79033,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -77824,7 +79056,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -78058,7 +79290,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -78186,8 +79418,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -78395,6 +79627,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -78411,8 +79648,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -78442,8 +79682,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -78488,7 +79728,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -78501,8 +79745,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -78543,7 +79787,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -78650,7 +79898,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -78703,8 +79951,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -78735,8 +79983,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -78811,8 +80059,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -78834,7 +80082,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -79068,7 +80316,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -79196,8 +80444,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -79405,6 +80653,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -79421,8 +80674,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -79452,8 +80708,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -79498,7 +80754,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -79511,8 +80771,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -79553,7 +80813,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -79660,7 +80924,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -79713,8 +80977,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -79745,8 +81009,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -79821,8 +81085,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -79844,7 +81108,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -80078,7 +81342,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -80206,8 +81470,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -80415,6 +81679,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -80431,8 +81700,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -80462,8 +81734,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -80508,7 +81780,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -80521,8 +81797,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -80563,7 +81839,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -80670,7 +81950,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -80723,8 +82003,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -80755,8 +82035,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -80831,8 +82111,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -80854,7 +82134,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -81088,7 +82368,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -81216,8 +82496,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -81425,6 +82705,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -81441,8 +82726,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -81472,8 +82760,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -81518,7 +82806,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -81531,8 +82823,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -81573,7 +82865,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -81680,7 +82976,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -81733,8 +83029,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -81765,8 +83061,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -81841,8 +83137,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -81864,7 +83160,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -82098,7 +83394,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -82226,8 +83522,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -82435,6 +83731,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -82451,8 +83752,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -82482,8 +83786,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -82528,7 +83832,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -82541,8 +83849,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -82583,7 +83891,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -82690,7 +84002,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -82743,8 +84055,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -82775,8 +84087,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -82851,8 +84163,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -82874,7 +84186,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -83108,7 +84420,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -83236,8 +84548,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -83445,8 +84757,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -83463,6 +84778,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -83492,8 +84812,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -83538,7 +84858,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -83551,8 +84875,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -83593,7 +84917,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -83700,7 +85028,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -83753,8 +85081,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -83785,8 +85113,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -83861,8 +85189,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -83884,7 +85212,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -84118,7 +85446,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -84246,8 +85574,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -84455,6 +85783,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -84471,8 +85804,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -84502,8 +85838,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -84548,7 +85884,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -84561,8 +85901,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -84603,7 +85943,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -84710,7 +86054,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -84763,8 +86107,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -84795,8 +86139,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -84871,8 +86215,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -84894,7 +86238,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -85128,7 +86472,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -85256,8 +86600,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -85465,8 +86809,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -85483,6 +86830,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -85512,8 +86864,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -85558,7 +86910,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -85571,8 +86927,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -85613,7 +86969,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -85720,7 +87080,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -85773,8 +87133,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -85805,8 +87165,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -85881,8 +87241,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -85904,7 +87264,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -86138,7 +87498,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -86266,8 +87626,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -86475,8 +87835,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -86493,6 +87856,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -86522,8 +87890,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -86568,7 +87936,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -86581,8 +87953,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -86623,7 +87995,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -86730,7 +88106,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -86783,8 +88159,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -86815,8 +88191,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -86891,8 +88267,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -86914,7 +88290,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -87148,7 +88524,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -87276,8 +88652,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -87485,6 +88861,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -87501,8 +88882,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -87532,8 +88916,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -87578,7 +88962,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -87591,8 +88979,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -87633,7 +89021,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -87740,7 +89132,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -87793,8 +89185,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -87825,8 +89217,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -87901,8 +89293,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -87924,7 +89316,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -88158,7 +89550,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -88286,8 +89678,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -88495,6 +89887,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -88511,8 +89908,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -88542,8 +89942,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -88588,7 +89988,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -88601,8 +90005,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -88643,7 +90047,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -88750,7 +90158,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -88803,8 +90211,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -88835,8 +90243,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -88911,8 +90319,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -88934,7 +90342,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -89168,7 +90576,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -89296,8 +90704,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -89505,6 +90913,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -89521,8 +90934,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -89552,8 +90968,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -89598,7 +91014,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -89611,8 +91031,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -89653,7 +91073,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -89760,7 +91184,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -89813,8 +91237,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -89845,8 +91269,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -89921,8 +91345,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -89944,7 +91368,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -90178,7 +91602,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -90306,8 +91730,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -90515,6 +91939,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -90531,8 +91960,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -90562,8 +91994,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -90608,7 +92040,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -90621,8 +92057,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -90663,7 +92099,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -90770,7 +92210,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -90823,8 +92263,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -90855,8 +92295,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -90931,8 +92371,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -90954,7 +92394,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -91188,7 +92628,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -91316,8 +92756,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -91525,6 +92965,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -91541,8 +92986,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -91572,8 +93020,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -91618,7 +93066,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -91631,8 +93083,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -91673,7 +93125,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -91780,7 +93236,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -91833,8 +93289,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -91865,8 +93321,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -91941,8 +93397,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -91964,7 +93420,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -92198,7 +93654,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -92326,8 +93782,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -92535,8 +93991,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -92553,6 +94012,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -92582,8 +94046,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -92628,7 +94092,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -92641,8 +94109,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -92683,7 +94151,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -92790,7 +94262,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -92843,8 +94315,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -92875,8 +94347,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -92951,8 +94423,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -92974,7 +94446,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -93208,7 +94680,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -93336,8 +94808,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -93545,6 +95017,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -93561,8 +95038,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -93592,8 +95072,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -93638,7 +95118,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -93651,8 +95135,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -93693,7 +95177,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -93800,7 +95288,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -93853,8 +95341,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -93885,8 +95373,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -93961,8 +95449,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -93984,7 +95472,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -94218,7 +95706,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -94346,8 +95834,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -94555,8 +96043,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -94573,6 +96064,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -94602,8 +96098,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -94648,7 +96144,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -94661,8 +96161,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -94703,7 +96203,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -94810,7 +96314,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -94863,8 +96367,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -94895,8 +96399,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -94971,8 +96475,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -94994,7 +96498,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -95228,7 +96732,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -95356,8 +96860,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -95565,8 +97069,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -95583,6 +97090,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -95612,8 +97124,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -95658,7 +97170,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -95671,8 +97187,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -95713,7 +97229,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -95820,7 +97340,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -95873,8 +97393,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -95905,8 +97425,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -95981,8 +97501,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -96004,7 +97524,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -96238,7 +97758,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -96366,8 +97886,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -96575,6 +98095,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -96591,8 +98116,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -96622,8 +98150,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -96668,7 +98196,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -96681,8 +98213,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -96723,7 +98255,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -96830,7 +98366,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -96883,8 +98419,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -96915,8 +98451,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -96991,8 +98527,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -97014,7 +98550,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -97248,7 +98784,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -97376,8 +98912,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -97585,6 +99121,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -97601,8 +99142,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -97632,8 +99176,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -97678,7 +99222,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -97691,8 +99239,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -97733,7 +99281,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -97840,7 +99392,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -97893,8 +99445,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -97925,8 +99477,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -98001,8 +99553,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -98024,7 +99576,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -98258,7 +99810,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -98386,8 +99938,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -98595,6 +100147,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -98611,8 +100168,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -98642,8 +100202,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -98688,7 +100248,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -98701,8 +100265,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -98743,7 +100307,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -98850,7 +100418,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -98903,8 +100471,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -98935,8 +100503,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -99011,8 +100579,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -99034,7 +100602,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -99268,7 +100836,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -99396,8 +100964,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -99605,6 +101173,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -99621,8 +101194,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -99652,8 +101228,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -99698,7 +101274,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -99711,8 +101291,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -99753,7 +101333,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -99860,7 +101444,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -99913,8 +101497,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -99945,8 +101529,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -100021,8 +101605,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -100044,7 +101628,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -100278,7 +101862,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -100406,8 +101990,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -100615,6 +102199,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -100631,8 +102220,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -100662,8 +102254,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -100708,7 +102300,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -100721,8 +102317,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -100763,7 +102359,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -100870,7 +102470,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -100923,8 +102523,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -100955,8 +102555,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -101031,8 +102631,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -101054,7 +102654,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -101288,7 +102888,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -101416,8 +103016,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -101625,8 +103225,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -101643,6 +103246,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -101672,8 +103280,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -101718,7 +103326,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -101731,8 +103343,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -101773,7 +103385,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -101880,7 +103496,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -101933,8 +103549,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -101965,8 +103581,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -102041,8 +103657,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -102064,7 +103680,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -102298,7 +103914,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -102426,8 +104042,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -102635,6 +104251,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -102651,8 +104272,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -102682,8 +104306,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -102728,7 +104352,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -102741,8 +104369,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -102783,7 +104411,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -102890,7 +104522,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -102943,8 +104575,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -102975,8 +104607,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -103051,8 +104683,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -103074,7 +104706,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -103308,7 +104940,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -103436,8 +105068,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -103645,8 +105277,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -103663,6 +105298,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -103692,8 +105332,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -103738,7 +105378,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -103751,8 +105395,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -103793,7 +105437,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -103900,7 +105548,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -103953,8 +105601,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -103985,8 +105633,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -104061,8 +105709,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -104084,7 +105732,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -104318,7 +105966,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -104446,8 +106094,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -104655,8 +106303,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -104673,6 +106324,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -104702,8 +106358,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -104748,7 +106404,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -104761,8 +106421,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -104803,7 +106463,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -104910,7 +106574,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -104963,8 +106627,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -104995,8 +106659,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -105071,8 +106735,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -105094,7 +106758,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -105328,7 +106992,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -105456,8 +107120,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -105665,6 +107329,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -105681,8 +107350,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -105712,8 +107384,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -105758,7 +107430,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -105771,8 +107447,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -105813,7 +107489,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -105920,7 +107600,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -105973,8 +107653,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -106005,8 +107685,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -106081,8 +107761,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -106104,7 +107784,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -106338,7 +108018,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -106466,8 +108146,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -106675,6 +108355,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -106691,8 +108376,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -106722,8 +108410,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -106768,7 +108456,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -106781,8 +108473,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -106823,7 +108515,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -106930,7 +108626,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -106983,8 +108679,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -107015,8 +108711,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -107091,8 +108787,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -107114,7 +108810,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -107348,7 +109044,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -107476,8 +109172,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -107685,6 +109381,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -107701,8 +109402,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -107732,8 +109436,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -107778,7 +109482,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -107791,8 +109499,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -107833,7 +109541,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -107940,7 +109652,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -107993,8 +109705,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -108025,8 +109737,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -108101,8 +109813,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -108124,7 +109836,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -108358,7 +110070,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -108486,8 +110198,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -108695,6 +110407,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -108711,8 +110428,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -108742,8 +110462,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -108788,7 +110508,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -108801,8 +110525,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -108843,7 +110567,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -108950,7 +110678,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -109003,8 +110731,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -109035,8 +110763,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -109111,8 +110839,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -109134,7 +110862,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -109368,7 +111096,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -109496,8 +111224,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -109705,6 +111433,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -109721,8 +111454,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -109752,8 +111488,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -109798,7 +111534,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -109811,8 +111551,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -109853,7 +111593,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -109960,7 +111704,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -110013,8 +111757,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -110045,8 +111789,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -110121,8 +111865,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -110144,7 +111888,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -110378,7 +112122,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -110506,8 +112250,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -110715,8 +112459,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -110733,6 +112480,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -110762,8 +112514,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -110808,7 +112560,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -110821,8 +112577,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -110863,7 +112619,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -110970,7 +112730,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -111023,8 +112783,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -111055,8 +112815,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -111131,8 +112891,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -111154,7 +112914,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -111388,7 +113148,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -111516,8 +113276,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -111725,6 +113485,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -111741,8 +113506,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -111772,8 +113540,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -111818,7 +113586,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -111831,8 +113603,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -111873,7 +113645,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -111980,7 +113756,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -112033,8 +113809,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -112065,8 +113841,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -112141,8 +113917,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -112164,7 +113940,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -112398,7 +114174,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -112526,8 +114302,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -112735,8 +114511,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -112753,6 +114532,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -112782,8 +114566,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -112828,7 +114612,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -112841,8 +114629,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -112883,7 +114671,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -112990,7 +114782,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -113043,8 +114835,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -113075,8 +114867,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -113151,8 +114943,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -113174,7 +114966,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -113408,7 +115200,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -113536,8 +115328,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -113745,8 +115537,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -113763,6 +115558,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -113792,8 +115592,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -113838,7 +115638,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -113851,8 +115655,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -113893,7 +115697,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -114000,7 +115808,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -114053,8 +115861,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -114085,8 +115893,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -114161,8 +115969,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -114184,7 +115992,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -114418,7 +116226,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -114546,8 +116354,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -114755,6 +116563,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -114771,8 +116584,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -114802,8 +116618,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -114848,7 +116664,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -114861,8 +116681,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -114903,7 +116723,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -115010,7 +116834,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -115063,8 +116887,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -115095,8 +116919,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -115171,8 +116995,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -115194,7 +117018,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -115428,7 +117252,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -115556,8 +117380,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -115765,6 +117589,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -115781,8 +117610,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -115812,8 +117644,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -115858,7 +117690,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -115871,8 +117707,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -115913,7 +117749,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -116020,7 +117860,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -116073,8 +117913,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -116105,8 +117945,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -116181,8 +118021,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -116204,7 +118044,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -116438,7 +118278,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -116566,8 +118406,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -116775,6 +118615,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -116791,8 +118636,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -116822,8 +118670,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -116868,7 +118716,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -116881,8 +118733,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -116923,7 +118775,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -117030,7 +118886,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -117083,8 +118939,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -117115,8 +118971,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -117191,8 +119047,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -117214,7 +119070,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -117448,7 +119304,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -117576,8 +119432,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -117785,6 +119641,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -117801,8 +119662,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -117832,8 +119696,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -117878,7 +119742,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -117891,8 +119759,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -117933,7 +119801,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -118040,7 +119912,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -118093,8 +119965,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -118125,8 +119997,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -118201,8 +120073,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -118224,7 +120096,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -118458,7 +120330,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -118586,8 +120458,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -118795,6 +120667,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -118811,8 +120688,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -118842,8 +120722,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -118888,7 +120768,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -118901,8 +120785,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -118943,7 +120827,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -119050,7 +120938,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -119103,8 +120991,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -119135,8 +121023,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -119211,8 +121099,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -119234,7 +121122,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -119468,7 +121356,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -119596,8 +121484,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -119805,8 +121693,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -119823,6 +121714,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -119852,8 +121748,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -119898,7 +121794,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -119911,8 +121811,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -119953,7 +121853,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -120060,7 +121964,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -120113,8 +122017,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -120145,8 +122049,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -120221,8 +122125,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -120244,7 +122148,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -120478,7 +122382,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -120606,8 +122510,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -120815,6 +122719,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -120831,8 +122740,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -120862,8 +122774,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -120908,7 +122820,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -120921,8 +122837,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -120963,7 +122879,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -121070,7 +122990,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -121123,8 +123043,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -121155,8 +123075,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -121231,8 +123151,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -121254,7 +123174,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -121488,7 +123408,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -121616,8 +123536,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -121825,8 +123745,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -121843,6 +123766,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -121872,8 +123800,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -121918,7 +123846,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -121931,8 +123863,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -121973,7 +123905,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -122080,7 +124016,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -122133,8 +124069,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -122165,8 +124101,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -122241,8 +124177,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -122264,7 +124200,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -122498,7 +124434,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -122626,8 +124562,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -122835,8 +124771,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -122853,6 +124792,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -122882,8 +124826,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -122928,7 +124872,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -122941,8 +124889,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -122983,7 +124931,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -123090,7 +125042,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -123143,8 +125095,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -123175,8 +125127,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -123251,8 +125203,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -123274,7 +125226,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -123508,7 +125460,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -123636,8 +125588,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -123845,6 +125797,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -123861,8 +125818,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -123892,8 +125852,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -123938,7 +125898,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -123951,8 +125915,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -123993,7 +125957,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -124100,7 +126068,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -124153,8 +126121,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -124185,8 +126153,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -124261,8 +126229,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -124284,7 +126252,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -124518,7 +126486,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -124646,8 +126614,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -124855,6 +126823,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -124871,8 +126844,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -124902,8 +126878,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -124948,7 +126924,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -124961,8 +126941,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -125003,7 +126983,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -125110,7 +127094,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -125163,8 +127147,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -125195,8 +127179,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -125271,8 +127255,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -125294,7 +127278,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -125528,7 +127512,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -125656,8 +127640,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -125865,6 +127849,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -125881,8 +127870,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -125912,8 +127904,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -125958,7 +127950,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -125971,8 +127967,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -126013,7 +128009,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -126120,7 +128120,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -126173,8 +128173,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -126205,8 +128205,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -126281,8 +128281,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -126304,7 +128304,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -126538,7 +128538,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -126666,8 +128666,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -126875,6 +128875,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -126891,8 +128896,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -126922,8 +128930,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -126968,7 +128976,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -126981,8 +128993,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -127023,7 +129035,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -127130,7 +129146,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -127183,8 +129199,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -127215,8 +129231,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -127291,8 +129307,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -127314,7 +129330,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -127548,7 +129564,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -127676,8 +129692,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -127885,6 +129901,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -127901,8 +129922,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -127932,8 +129956,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -127978,7 +130002,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -127991,8 +130019,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -128033,7 +130061,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -128140,7 +130172,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -128193,8 +130225,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -128225,8 +130257,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -128301,8 +130333,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -128324,7 +130356,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -128558,7 +130590,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -128686,8 +130718,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -128895,8 +130927,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -128913,6 +130948,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -128942,8 +130982,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -128988,7 +131028,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -129001,8 +131045,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -129043,7 +131087,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -129150,7 +131198,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -129203,8 +131251,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -129235,8 +131283,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -129311,8 +131359,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -129334,7 +131382,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -129568,7 +131616,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -129696,8 +131744,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -129905,6 +131953,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -129921,8 +131974,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -129952,8 +132008,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -129998,7 +132054,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -130011,8 +132071,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -130053,7 +132113,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -130160,7 +132224,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -130213,8 +132277,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -130245,8 +132309,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -130321,8 +132385,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -130344,7 +132408,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -130578,7 +132642,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -130706,8 +132770,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -130915,8 +132979,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -130933,6 +133000,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -130962,8 +133034,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -131008,7 +133080,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -131021,8 +133097,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -131063,7 +133139,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -131170,7 +133250,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -131223,8 +133303,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -131255,8 +133335,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -131331,8 +133411,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -131354,7 +133434,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -131588,7 +133668,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -131716,8 +133796,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -131925,8 +134005,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -131943,6 +134026,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -131972,8 +134060,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -132018,7 +134106,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -132031,8 +134123,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -132073,7 +134165,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -132180,7 +134276,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -132233,8 +134329,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -132265,8 +134361,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -132341,8 +134437,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -132364,7 +134460,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -132598,7 +134694,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -132726,8 +134822,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -132935,6 +135031,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -132951,8 +135052,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -132982,8 +135086,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -133028,7 +135132,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -133041,8 +135149,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -133083,7 +135191,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -133190,7 +135302,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -133243,8 +135355,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -133275,8 +135387,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -133351,8 +135463,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -133374,7 +135486,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -133608,7 +135720,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -133736,8 +135848,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -133945,6 +136057,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -133961,8 +136078,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -133992,8 +136112,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -134038,7 +136158,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -134051,8 +136175,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -134093,7 +136217,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -134200,7 +136328,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -134253,8 +136381,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -134285,8 +136413,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -134361,8 +136489,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -134384,7 +136512,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -134618,7 +136746,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -134746,8 +136874,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -134955,6 +137083,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -134971,8 +137104,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -135002,8 +137138,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -135048,7 +137184,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -135061,8 +137201,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -135103,7 +137243,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -135210,7 +137354,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -135263,8 +137407,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -135295,8 +137439,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -135371,8 +137515,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -135394,7 +137538,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -135628,7 +137772,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -135756,8 +137900,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -135965,6 +138109,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -135981,8 +138130,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -136012,8 +138164,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -136058,7 +138210,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -136071,8 +138227,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -136113,7 +138269,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -136220,7 +138380,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -136273,8 +138433,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -136305,8 +138465,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -136381,8 +138541,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -136404,7 +138564,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -136638,7 +138798,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -136766,8 +138926,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -136975,6 +139135,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -136991,8 +139156,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -137022,8 +139190,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -137068,7 +139236,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -137081,8 +139253,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -137123,7 +139295,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -137230,7 +139406,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -137283,8 +139459,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -137315,8 +139491,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -137391,8 +139567,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -137414,7 +139590,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -137648,7 +139824,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -137776,8 +139952,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -137985,8 +140161,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -138003,6 +140182,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -138032,8 +140216,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -138078,7 +140262,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -138091,8 +140279,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -138133,7 +140321,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -138240,7 +140432,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -138293,8 +140485,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -138325,8 +140517,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -138401,8 +140593,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -138424,7 +140616,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -138658,7 +140850,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -138786,8 +140978,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -138995,6 +141187,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -139011,8 +141208,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -139042,8 +141242,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -139088,7 +141288,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -139101,8 +141305,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -139143,7 +141347,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -139250,7 +141458,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -139303,8 +141511,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -139335,8 +141543,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -139411,8 +141619,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -139434,7 +141642,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -139668,7 +141876,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -139796,8 +142004,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -140005,8 +142213,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -140023,6 +142234,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -140052,8 +142268,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -140098,7 +142314,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -140111,8 +142331,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -140153,7 +142373,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -140260,7 +142484,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -140313,8 +142537,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -140345,8 +142569,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -140421,8 +142645,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -140444,7 +142668,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -140678,7 +142902,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -140806,8 +143030,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -141015,8 +143239,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -141033,6 +143260,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -141062,8 +143294,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -141108,7 +143340,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -141121,8 +143357,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -141163,7 +143399,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -141270,7 +143510,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -141323,8 +143563,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -141355,8 +143595,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -141431,8 +143671,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -141454,7 +143694,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -141688,7 +143928,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -141816,8 +144056,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -142025,6 +144265,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -142041,8 +144286,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -142072,8 +144320,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -142118,7 +144366,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -142131,8 +144383,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -142173,7 +144425,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -142280,7 +144536,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -142333,8 +144589,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -142365,8 +144621,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -142441,8 +144697,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -142464,7 +144720,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -142698,7 +144954,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -142826,8 +145082,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -143035,6 +145291,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -143051,8 +145312,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -143082,8 +145346,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -143128,7 +145392,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -143141,8 +145409,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -143183,7 +145451,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -143290,7 +145562,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -143343,8 +145615,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -143375,8 +145647,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -143451,8 +145723,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -143474,7 +145746,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -143708,7 +145980,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -143836,8 +146108,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -144045,6 +146317,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -144061,8 +146338,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -144092,8 +146372,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -144138,7 +146418,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -144151,8 +146435,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -144193,7 +146477,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -144300,7 +146588,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -144353,8 +146641,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -144385,8 +146673,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -144461,8 +146749,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -144484,7 +146772,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -144718,7 +147006,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -144846,8 +147134,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -145055,6 +147343,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -145071,8 +147364,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -145102,8 +147398,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -145148,7 +147444,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -145161,8 +147461,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -145203,7 +147503,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -145310,7 +147614,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -145363,8 +147667,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -145395,8 +147699,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -145471,8 +147775,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -145494,7 +147798,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -145728,7 +148032,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -145856,8 +148160,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -146065,6 +148369,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -146081,8 +148390,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -146112,8 +148424,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -146158,7 +148470,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -146171,8 +148487,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -146213,7 +148529,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -146320,7 +148640,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -146373,8 +148693,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -146405,8 +148725,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -146481,8 +148801,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -146504,7 +148824,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -146738,7 +149058,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -146866,8 +149186,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -147075,8 +149395,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -147093,6 +149416,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -147122,8 +149450,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -147168,7 +149496,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -147181,8 +149513,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -147223,7 +149555,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -147330,7 +149666,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -147383,8 +149719,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -147415,8 +149751,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -147491,8 +149827,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -147514,7 +149850,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -147748,7 +150084,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -147876,8 +150212,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -148085,6 +150421,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -148101,8 +150442,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -148132,8 +150476,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -148178,7 +150522,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -148191,8 +150539,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -148233,7 +150581,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -148340,7 +150692,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -148393,8 +150745,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -148425,8 +150777,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -148501,8 +150853,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -148524,7 +150876,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -148758,7 +151110,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -148886,8 +151238,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -149095,8 +151447,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -149113,6 +151468,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -149142,8 +151502,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -149188,7 +151548,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -149201,8 +151565,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -149243,7 +151607,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -149350,7 +151718,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -149403,8 +151771,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -149435,8 +151803,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -149511,8 +151879,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -149534,7 +151902,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -149768,7 +152136,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -149896,8 +152264,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -150105,8 +152473,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -150123,6 +152494,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -150152,8 +152528,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -150198,7 +152574,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -150211,8 +152591,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -150253,7 +152633,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -150360,7 +152744,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -150413,8 +152797,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -150445,8 +152829,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -150521,8 +152905,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -150544,7 +152928,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -150778,7 +153162,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -150906,8 +153290,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -151115,6 +153499,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -151131,8 +153520,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -151162,8 +153554,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -151208,7 +153600,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -151221,8 +153617,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -151263,7 +153659,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -151370,7 +153770,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -151423,8 +153823,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -151455,8 +153855,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -151531,8 +153931,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -151554,7 +153954,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -151788,7 +154188,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -151916,8 +154316,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -152125,6 +154525,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -152141,8 +154546,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -152172,8 +154580,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -152218,7 +154626,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -152231,8 +154643,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -152273,7 +154685,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -152380,7 +154796,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -152433,8 +154849,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -152465,8 +154881,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -152541,8 +154957,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -152564,7 +154980,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -152798,7 +155214,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -152926,8 +155342,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -153135,6 +155551,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -153151,8 +155572,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -153182,8 +155606,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -153228,7 +155652,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -153241,8 +155669,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -153283,7 +155711,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -153390,7 +155822,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -153443,8 +155875,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -153475,8 +155907,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -153551,8 +155983,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -153574,7 +156006,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -153808,7 +156240,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -153936,8 +156368,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -154145,6 +156577,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -154161,8 +156598,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -154192,8 +156632,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -154238,7 +156678,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -154251,8 +156695,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -154293,7 +156737,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -154400,7 +156848,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -154453,8 +156901,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -154485,8 +156933,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -154561,8 +157009,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -154584,7 +157032,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -154818,7 +157266,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -154946,8 +157394,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -155155,6 +157603,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -155171,8 +157624,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -155202,8 +157658,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -155248,7 +157704,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -155261,8 +157721,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -155303,7 +157763,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -155410,7 +157874,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -155463,8 +157927,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -155495,8 +157959,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -155571,8 +158035,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -155594,7 +158058,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -155828,7 +158292,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -155956,8 +158420,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -156165,8 +158629,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -156183,6 +158650,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -156212,8 +158684,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -156258,7 +158730,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -156271,8 +158747,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -156313,7 +158789,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -156420,7 +158900,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -156473,8 +158953,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -156505,8 +158985,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -156581,8 +159061,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -156604,7 +159084,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -156838,7 +159318,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -156966,8 +159446,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -157175,6 +159655,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -157191,8 +159676,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -157222,8 +159710,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -157268,7 +159756,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -157281,8 +159773,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -157323,7 +159815,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -157430,7 +159926,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -157483,8 +159979,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -157515,8 +160011,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -157591,8 +160087,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -157614,7 +160110,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -157848,7 +160344,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -157976,8 +160472,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -158185,8 +160681,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -158203,6 +160702,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -158232,8 +160736,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -158278,7 +160782,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -158291,8 +160799,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -158333,7 +160841,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -158440,7 +160952,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -158493,8 +161005,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -158525,8 +161037,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -158601,8 +161113,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -158624,7 +161136,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -158858,7 +161370,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -158986,8 +161498,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -159195,8 +161707,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -159213,6 +161728,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -159242,8 +161762,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -159288,7 +161808,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -159301,8 +161825,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -159343,7 +161867,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -159450,7 +161978,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -159503,8 +162031,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -159535,8 +162063,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -159611,8 +162139,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -159634,7 +162162,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -159868,7 +162396,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -159996,8 +162524,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -160205,6 +162733,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -160221,8 +162754,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -160252,8 +162788,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -160298,7 +162834,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -160311,8 +162851,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -160353,7 +162893,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -160460,7 +163004,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -160513,8 +163057,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -160545,8 +163089,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -160621,8 +163165,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -160644,7 +163188,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -160878,7 +163422,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -161006,8 +163550,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -161215,6 +163759,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -161231,8 +163780,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -161262,8 +163814,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -161308,7 +163860,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -161321,8 +163877,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -161363,7 +163919,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -161470,7 +164030,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -161523,8 +164083,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -161555,8 +164115,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -161631,8 +164191,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -161654,7 +164214,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -161888,7 +164448,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -162016,8 +164576,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -162225,6 +164785,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -162241,8 +164806,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -162272,8 +164840,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -162318,7 +164886,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -162331,8 +164903,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -162373,7 +164945,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -162480,7 +165056,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -162533,8 +165109,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -162565,8 +165141,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -162641,8 +165217,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -162664,7 +165240,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -162898,7 +165474,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -163026,8 +165602,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -163235,6 +165811,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -163251,8 +165832,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -163282,8 +165866,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -163328,7 +165912,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -163341,8 +165929,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -163383,7 +165971,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -163490,7 +166082,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -163543,8 +166135,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -163575,8 +166167,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -163651,8 +166243,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -163674,7 +166266,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -163908,7 +166500,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -164036,8 +166628,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -164245,6 +166837,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -164261,8 +166858,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -164292,8 +166892,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -164338,7 +166938,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -164351,8 +166955,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -164393,7 +166997,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -164500,7 +167108,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -164553,8 +167161,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -164585,8 +167193,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -164661,8 +167269,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -164684,7 +167292,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -164918,7 +167526,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -165046,8 +167654,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -165255,8 +167863,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -165273,6 +167884,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -165302,8 +167918,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -165348,7 +167964,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -165361,8 +167981,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -165403,7 +168023,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -165510,7 +168134,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -165563,8 +168187,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -165595,8 +168219,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -165671,8 +168295,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -165694,7 +168318,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -165928,7 +168552,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -166056,8 +168680,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -166265,6 +168889,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -166281,8 +168910,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -166312,8 +168944,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -166358,7 +168990,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -166371,8 +169007,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -166413,7 +169049,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -166520,7 +169160,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -166573,8 +169213,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -166605,8 +169245,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -166681,8 +169321,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -166704,7 +169344,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -166938,7 +169578,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -167066,8 +169706,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -167275,8 +169915,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -167293,6 +169936,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -167322,8 +169970,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -167368,7 +170016,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -167381,8 +170033,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -167423,7 +170075,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -167530,7 +170186,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -167583,8 +170239,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -167615,8 +170271,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -167691,8 +170347,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -167714,7 +170370,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -167948,7 +170604,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -168076,8 +170732,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -168285,8 +170941,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -168303,6 +170962,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -168332,8 +170996,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -168378,7 +171042,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -168391,8 +171059,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -168433,7 +171101,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -168540,7 +171212,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -168593,8 +171265,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -168625,8 +171297,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -168701,8 +171373,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -168724,7 +171396,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -168958,7 +171630,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -169086,8 +171758,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -169295,6 +171967,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -169311,8 +171988,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -169342,8 +172022,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -169388,7 +172068,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -169401,8 +172085,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -169443,7 +172127,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -169550,7 +172238,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -169603,8 +172291,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -169635,8 +172323,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -169711,8 +172399,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -169734,7 +172422,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -169968,7 +172656,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -170096,8 +172784,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -170305,6 +172993,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -170321,8 +173014,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -170352,8 +173048,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -170398,7 +173094,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -170411,8 +173111,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -170453,7 +173153,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -170560,7 +173264,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -170613,8 +173317,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -170645,8 +173349,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -170721,8 +173425,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -170744,7 +173448,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -170978,7 +173682,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -171106,8 +173810,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -171315,6 +174019,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -171331,8 +174040,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -171362,8 +174074,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -171408,7 +174120,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -171421,8 +174137,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -171463,7 +174179,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -171570,7 +174290,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -171623,8 +174343,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -171655,8 +174375,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -171731,8 +174451,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -171754,7 +174474,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -171988,7 +174708,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -172116,8 +174836,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -172325,6 +175045,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -172341,8 +175066,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -172372,8 +175100,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -172418,7 +175146,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -172431,8 +175163,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -172473,7 +175205,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -172580,7 +175316,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -172633,8 +175369,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -172665,8 +175401,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -172741,8 +175477,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -172764,7 +175500,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -172998,7 +175734,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -173126,8 +175862,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -173335,6 +176071,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -173351,8 +176092,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -173382,8 +176126,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -173428,7 +176172,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -173441,8 +176189,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -173483,7 +176231,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -173590,7 +176342,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -173643,8 +176395,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -173675,8 +176427,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -173751,8 +176503,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -173774,7 +176526,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -174008,7 +176760,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -174136,8 +176888,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -174345,8 +177097,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -174363,6 +177118,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -174392,8 +177152,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -174438,7 +177198,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -174451,8 +177215,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -174493,7 +177257,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -174600,7 +177368,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -174653,8 +177421,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -174685,8 +177453,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -174761,8 +177529,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -174784,7 +177552,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -175018,7 +177786,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -175146,8 +177914,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -175355,6 +178123,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -175371,8 +178144,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -175402,8 +178178,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -175448,7 +178224,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -175461,8 +178241,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -175503,7 +178283,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -175610,7 +178394,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -175663,8 +178447,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -175695,8 +178479,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -175771,8 +178555,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -175794,7 +178578,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -176028,7 +178812,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -176156,8 +178940,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -176365,8 +179149,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -176383,6 +179170,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -176412,8 +179204,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -176458,7 +179250,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -176471,8 +179267,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -176513,7 +179309,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -176620,7 +179420,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -176673,8 +179473,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -176705,8 +179505,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -176781,8 +179581,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -176804,7 +179604,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -177038,7 +179838,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -177166,8 +179966,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -177375,8 +180175,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -177393,6 +180196,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -177422,8 +180230,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -177468,7 +180276,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -177481,8 +180293,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -177523,7 +180335,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -177630,7 +180446,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -177683,8 +180499,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -177715,8 +180531,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -177791,8 +180607,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -177814,7 +180630,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -178048,7 +180864,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -178176,8 +180992,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -178385,6 +181201,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -178401,8 +181222,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -178432,8 +181256,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -178478,7 +181302,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -178491,8 +181319,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -178533,7 +181361,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -178640,7 +181472,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -178693,8 +181525,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -178725,8 +181557,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -178801,8 +181633,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -178824,7 +181656,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -179058,7 +181890,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -179186,8 +182018,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -179395,6 +182227,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -179411,8 +182248,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -179442,8 +182282,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -179488,7 +182328,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -179501,8 +182345,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -179543,7 +182387,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -179650,7 +182498,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -179703,8 +182551,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -179735,8 +182583,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -179811,8 +182659,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -179834,7 +182682,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -180068,7 +182916,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -180196,8 +183044,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -180405,6 +183253,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -180421,8 +183274,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -180452,8 +183308,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -180498,7 +183354,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -180511,8 +183371,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -180553,7 +183413,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -180660,7 +183524,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -180713,8 +183577,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -180745,8 +183609,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -180821,8 +183685,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -180844,7 +183708,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -181078,7 +183942,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -181206,8 +184070,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -181415,6 +184279,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -181431,8 +184300,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -181462,8 +184334,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -181508,7 +184380,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -181521,8 +184397,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -181563,7 +184439,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -181670,7 +184550,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -181723,8 +184603,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -181755,8 +184635,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -181831,8 +184711,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -181854,7 +184734,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -182088,7 +184968,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -182216,8 +185096,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -182425,6 +185305,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -182441,8 +185326,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -182472,8 +185360,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -182518,7 +185406,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -182531,8 +185423,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -182573,7 +185465,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -182680,7 +185576,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -182733,8 +185629,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -182765,8 +185661,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -182841,8 +185737,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -182864,7 +185760,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -183098,7 +185994,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -183226,8 +186122,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -183435,8 +186331,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -183453,6 +186352,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -183482,8 +186386,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -183528,7 +186432,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -183541,8 +186449,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -183583,7 +186491,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -183690,7 +186602,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -183743,8 +186655,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -183775,8 +186687,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -183851,8 +186763,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -183874,7 +186786,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -184108,7 +187020,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -184236,8 +187148,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -184445,6 +187357,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -184461,8 +187378,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -184492,8 +187412,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -184538,7 +187458,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -184551,8 +187475,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -184593,7 +187517,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -184700,7 +187628,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -184753,8 +187681,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -184785,8 +187713,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -184861,8 +187789,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -184884,7 +187812,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -185118,7 +188046,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -185246,8 +188174,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -185455,8 +188383,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -185473,6 +188404,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -185502,8 +188438,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -185548,7 +188484,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -185561,8 +188501,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -185603,7 +188543,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -185710,7 +188654,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -185763,8 +188707,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -185795,8 +188739,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -185871,8 +188815,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -185894,7 +188838,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -186128,7 +189072,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -186256,8 +189200,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -186465,8 +189409,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -186483,6 +189430,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -186512,8 +189464,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -186558,7 +189510,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -186571,8 +189527,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -186613,7 +189569,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -186720,7 +189680,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -186773,8 +189733,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -186805,8 +189765,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -186881,8 +189841,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -186904,7 +189864,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -187138,7 +190098,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -187266,8 +190226,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -187475,6 +190435,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -187491,8 +190456,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -187522,8 +190490,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -187568,7 +190536,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -187581,8 +190553,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -187623,7 +190595,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -187730,7 +190706,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -187783,8 +190759,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -187815,8 +190791,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -187891,8 +190867,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -187914,7 +190890,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -188148,7 +191124,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -188276,8 +191252,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -188485,6 +191461,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -188501,8 +191482,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -188532,8 +191516,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -188578,7 +191562,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -188591,8 +191579,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -188633,7 +191621,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -188740,7 +191732,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -188793,8 +191785,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -188825,8 +191817,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -188901,8 +191893,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -188924,7 +191916,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -189158,7 +192150,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -189286,8 +192278,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -189495,6 +192487,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -189511,8 +192508,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -189542,8 +192542,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -189588,7 +192588,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -189601,8 +192605,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -189643,7 +192647,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -189750,7 +192758,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -189803,8 +192811,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -189835,8 +192843,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -189911,8 +192919,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -189934,7 +192942,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -190168,7 +193176,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -190296,8 +193304,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -190505,6 +193513,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -190521,8 +193534,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -190552,8 +193568,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -190598,7 +193614,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -190611,8 +193631,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -190653,7 +193673,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -190760,7 +193784,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -190813,8 +193837,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -190845,8 +193869,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -190921,8 +193945,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -190944,7 +193968,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -191178,7 +194202,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -191306,8 +194330,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -191515,6 +194539,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -191531,8 +194560,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -191562,8 +194594,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -191608,7 +194640,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -191621,8 +194657,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -191663,7 +194699,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -191770,7 +194810,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -191823,8 +194863,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -191855,8 +194895,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -191931,8 +194971,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -191954,7 +194994,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -192188,7 +195228,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -192316,8 +195356,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -192525,8 +195565,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -192543,6 +195586,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -192572,8 +195620,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -192618,7 +195666,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -192631,8 +195683,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -192673,7 +195725,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -192780,7 +195836,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -192833,8 +195889,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -192865,8 +195921,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -192941,8 +195997,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -192964,7 +196020,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -193198,7 +196254,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -193326,8 +196382,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -193535,6 +196591,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -193551,8 +196612,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -193582,8 +196646,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -193628,7 +196692,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -193641,8 +196709,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -193683,7 +196751,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -193790,7 +196862,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -193843,8 +196915,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -193875,8 +196947,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -193951,8 +197023,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -193974,7 +197046,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -194208,7 +197280,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -194336,8 +197408,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -194545,8 +197617,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -194563,6 +197638,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -194592,8 +197672,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -194638,7 +197718,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -194651,8 +197735,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -194693,7 +197777,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -194800,7 +197888,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -194853,8 +197941,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -194885,8 +197973,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -194961,8 +198049,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -194984,7 +198072,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -195218,7 +198306,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -195346,8 +198434,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -195555,8 +198643,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -195573,6 +198664,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -195602,8 +198698,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -195648,7 +198744,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -195661,8 +198761,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -195703,7 +198803,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -195810,7 +198914,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -195863,8 +198967,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -195895,8 +198999,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -195971,8 +199075,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -195994,7 +199098,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -196228,7 +199332,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -196356,8 +199460,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -196565,6 +199669,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -196581,8 +199690,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -196612,8 +199724,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -196658,7 +199770,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -196671,8 +199787,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -196713,7 +199829,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -196820,7 +199940,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -196873,8 +199993,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -196905,8 +200025,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -196981,8 +200101,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -197004,7 +200124,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -197238,7 +200358,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -197366,8 +200486,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -197575,6 +200695,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -197591,8 +200716,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -197622,8 +200750,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -197668,7 +200796,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -197681,8 +200813,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -197723,7 +200855,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -197830,7 +200966,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -197883,8 +201019,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -197915,8 +201051,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -197991,8 +201127,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -198014,7 +201150,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -198248,7 +201384,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -198376,8 +201512,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -198585,6 +201721,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -198601,8 +201742,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -198632,8 +201776,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -198678,7 +201822,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -198691,8 +201839,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -198733,7 +201881,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -198840,7 +201992,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -198893,8 +202045,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -198925,8 +202077,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -199001,8 +202153,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -199024,7 +202176,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -199258,7 +202410,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -199386,8 +202538,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -199595,6 +202747,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -199611,8 +202768,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -199642,8 +202802,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -199688,7 +202848,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -199701,8 +202865,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -199743,7 +202907,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -199850,7 +203018,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -199903,8 +203071,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -199935,8 +203103,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -200011,8 +203179,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -200034,7 +203202,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -200268,7 +203436,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -200396,8 +203564,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -200605,6 +203773,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -200621,8 +203794,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -200652,8 +203828,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -200698,7 +203874,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -200711,8 +203891,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -200753,7 +203933,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -200860,7 +204044,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -200913,8 +204097,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -200945,8 +204129,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -201021,8 +204205,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -201044,7 +204228,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -201278,7 +204462,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -201406,8 +204590,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -201615,8 +204799,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -201633,6 +204820,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -201662,8 +204854,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -201708,7 +204900,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -201721,8 +204917,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -201763,7 +204959,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -201870,7 +205070,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -201923,8 +205123,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -201955,8 +205155,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -202031,8 +205231,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -202054,7 +205254,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -202288,7 +205488,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -202416,8 +205616,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -202625,6 +205825,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -202641,8 +205846,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -202672,8 +205880,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -202718,7 +205926,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -202731,8 +205943,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -202773,7 +205985,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -202880,7 +206096,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -202933,8 +206149,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -202965,8 +206181,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -203041,8 +206257,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -203064,7 +206280,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -203298,7 +206514,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -203426,8 +206642,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -203635,8 +206851,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -203653,6 +206872,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -203682,8 +206906,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -203728,7 +206952,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -203741,8 +206969,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -203783,7 +207011,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -203890,7 +207122,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -203943,8 +207175,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -203975,8 +207207,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -204051,8 +207283,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -204074,7 +207306,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -204308,7 +207540,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -204436,8 +207668,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -204645,8 +207877,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -204663,6 +207898,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -204692,8 +207932,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -204738,7 +207978,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -204751,8 +207995,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -204793,7 +208037,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -204900,7 +208148,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -204953,8 +208201,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -204985,8 +208233,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -205061,8 +208309,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -205084,7 +208332,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -205318,7 +208566,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -205446,8 +208694,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -205655,6 +208903,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -205671,8 +208924,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -205702,8 +208958,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -205748,7 +209004,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -205761,8 +209021,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -205803,7 +209063,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -205910,7 +209174,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -205963,8 +209227,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -205995,8 +209259,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -206071,8 +209335,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -206094,7 +209358,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -206328,7 +209592,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -206456,8 +209720,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -206665,6 +209929,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -206681,8 +209950,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -206712,8 +209984,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -206758,7 +210030,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -206771,8 +210047,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -206813,7 +210089,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -206920,7 +210200,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -206973,8 +210253,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -207005,8 +210285,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -207081,8 +210361,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -207104,7 +210384,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -207338,7 +210618,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -207466,8 +210746,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -207675,6 +210955,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -207691,8 +210976,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -207722,8 +211010,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -207768,7 +211056,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -207781,8 +211073,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -207823,7 +211115,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -207930,7 +211226,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -207983,8 +211279,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -208015,8 +211311,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -208091,8 +211387,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -208114,7 +211410,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -208348,7 +211644,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -208476,8 +211772,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -208685,6 +211981,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -208701,8 +212002,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -208732,8 +212036,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -208778,7 +212082,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -208791,8 +212099,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -208833,7 +212141,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -208940,7 +212252,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -208993,8 +212305,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -209025,8 +212337,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -209101,8 +212413,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -209124,7 +212436,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -209358,7 +212670,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -209486,8 +212798,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -209695,6 +213007,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -209711,8 +213028,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -209742,8 +213062,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -209788,7 +213108,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -209801,8 +213125,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -209843,7 +213167,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -209950,7 +213278,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -210003,8 +213331,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -210035,8 +213363,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -210111,8 +213439,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -210134,7 +213462,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -210368,7 +213696,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -210496,8 +213824,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -210705,8 +214033,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -210723,6 +214054,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -210752,8 +214088,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -210798,7 +214134,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -210811,8 +214151,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -210853,7 +214193,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -210960,7 +214304,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -211013,8 +214357,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -211045,8 +214389,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -211121,8 +214465,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -211144,7 +214488,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -211378,7 +214722,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -211506,8 +214850,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -211715,6 +215059,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -211731,8 +215080,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -211762,8 +215114,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -211808,7 +215160,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -211821,8 +215177,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -211863,7 +215219,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -211970,7 +215330,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -212023,8 +215383,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -212055,8 +215415,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -212131,8 +215491,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -212154,7 +215514,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -212388,7 +215748,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -212516,8 +215876,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -212725,8 +216085,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -212743,6 +216106,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -212772,8 +216140,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -212818,7 +216186,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -212831,8 +216203,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -212873,7 +216245,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -212980,7 +216356,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -213033,8 +216409,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -213065,8 +216441,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -213141,8 +216517,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -213164,7 +216540,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -213398,7 +216774,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -213526,8 +216902,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -213735,8 +217111,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -213753,6 +217132,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -213782,8 +217166,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -213828,7 +217212,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -213841,8 +217229,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -213883,7 +217271,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -213990,7 +217382,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -214043,8 +217435,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -214075,8 +217467,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -214151,8 +217543,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -214174,7 +217566,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -214408,7 +217800,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -214536,8 +217928,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -214745,6 +218137,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -214761,8 +218158,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -214792,8 +218192,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -214838,7 +218238,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -214851,8 +218255,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -214893,7 +218297,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -215000,7 +218408,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -215053,8 +218461,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -215085,8 +218493,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -215161,8 +218569,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -215184,7 +218592,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -215418,7 +218826,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -215546,8 +218954,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -215755,6 +219163,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -215771,8 +219184,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -215802,8 +219218,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -215848,7 +219264,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -215861,8 +219281,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -215903,7 +219323,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -216010,7 +219434,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -216063,8 +219487,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -216095,8 +219519,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -216171,8 +219595,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -216194,7 +219618,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -216428,7 +219852,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -216556,8 +219980,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -216765,6 +220189,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -216781,8 +220210,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -216812,8 +220244,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -216858,7 +220290,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -216871,8 +220307,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -216913,7 +220349,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -217020,7 +220460,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -217073,8 +220513,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -217105,8 +220545,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -217181,8 +220621,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -217204,7 +220644,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -217438,7 +220878,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -217566,8 +221006,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -217775,6 +221215,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -217791,8 +221236,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -217822,8 +221270,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -217868,7 +221316,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -217881,8 +221333,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -217923,7 +221375,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -218030,7 +221486,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -218083,8 +221539,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -218115,8 +221571,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -218191,8 +221647,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -218214,7 +221670,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -218448,7 +221904,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -218576,8 +222032,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -218785,6 +222241,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -218801,8 +222262,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -218832,8 +222296,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -218878,7 +222342,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -218891,8 +222359,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -218933,7 +222401,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -219040,7 +222512,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -219093,8 +222565,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -219125,8 +222597,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -219201,8 +222673,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -219224,7 +222696,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -219458,7 +222930,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -219586,8 +223058,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -219795,8 +223267,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -219813,6 +223288,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -219842,8 +223322,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -219888,7 +223368,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -219901,8 +223385,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -219943,7 +223427,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -220050,7 +223538,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -220103,8 +223591,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -220135,8 +223623,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -220211,8 +223699,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -220234,7 +223722,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -220468,7 +223956,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -220596,8 +224084,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -220805,6 +224293,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -220821,8 +224314,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -220852,8 +224348,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -220898,7 +224394,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -220911,8 +224411,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -220953,7 +224453,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -221060,7 +224564,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -221113,8 +224617,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -221145,8 +224649,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -221221,8 +224725,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -221244,7 +224748,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -221478,7 +224982,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -221606,8 +225110,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -221815,8 +225319,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -221833,6 +225340,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -221862,8 +225374,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -221908,7 +225420,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -221921,8 +225437,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -221963,7 +225479,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -222070,7 +225590,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -222123,8 +225643,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -222155,8 +225675,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -222231,8 +225751,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -222254,7 +225774,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -222488,7 +226008,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -222616,8 +226136,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -222825,8 +226345,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -222843,6 +226366,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -222872,8 +226400,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -222918,7 +226446,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -222931,8 +226463,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -222973,7 +226505,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -223080,7 +226616,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -223133,8 +226669,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -223165,8 +226701,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -223241,8 +226777,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -223264,7 +226800,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -223498,7 +227034,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -223626,8 +227162,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -223835,6 +227371,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -223851,8 +227392,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -223882,8 +227426,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -223928,7 +227472,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -223941,8 +227489,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -223983,7 +227531,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -224090,7 +227642,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -224143,8 +227695,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -224175,8 +227727,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -224251,8 +227803,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -224274,7 +227826,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -224508,7 +228060,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -224636,8 +228188,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -224845,6 +228397,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -224861,8 +228418,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -224892,8 +228452,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -224938,7 +228498,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -224951,8 +228515,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -224993,7 +228557,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -225100,7 +228668,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -225153,8 +228721,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -225185,8 +228753,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -225261,8 +228829,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -225284,7 +228852,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -225518,7 +229086,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -225646,8 +229214,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -225855,6 +229423,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -225871,8 +229444,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -225902,8 +229478,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -225948,7 +229524,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -225961,8 +229541,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -226003,7 +229583,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -226110,7 +229694,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -226163,8 +229747,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -226195,8 +229779,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -226271,8 +229855,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -226294,7 +229878,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -226528,7 +230112,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -226656,8 +230240,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -226865,6 +230449,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -226881,8 +230470,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -226912,8 +230504,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -226958,7 +230550,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -226971,8 +230567,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -227013,7 +230609,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -227120,7 +230720,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -227173,8 +230773,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -227205,8 +230805,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -227281,8 +230881,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -227304,7 +230904,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -227538,7 +231138,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -227666,8 +231266,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -227875,6 +231475,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -227891,8 +231496,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -227922,8 +231530,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -227968,7 +231576,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -227981,8 +231593,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -228023,7 +231635,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -228130,7 +231746,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -228183,8 +231799,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -228215,8 +231831,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -228291,8 +231907,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -228314,7 +231930,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -228548,7 +232164,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -228676,8 +232292,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -228885,8 +232501,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -228903,6 +232522,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -228932,8 +232556,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -228978,7 +232602,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -228991,8 +232619,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -229033,7 +232661,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -229140,7 +232772,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -229193,8 +232825,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -229225,8 +232857,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -229301,8 +232933,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -229324,7 +232956,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -229558,7 +233190,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -229686,8 +233318,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -229895,6 +233527,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -229911,8 +233548,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -229942,8 +233582,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -229988,7 +233628,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -230001,8 +233645,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -230043,7 +233687,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -230150,7 +233798,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -230203,8 +233851,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -230235,8 +233883,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -230311,8 +233959,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -230334,7 +233982,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -230568,7 +234216,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -230696,8 +234344,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -230905,8 +234553,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -230923,6 +234574,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -230952,8 +234608,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -230998,7 +234654,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -231011,8 +234671,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -231053,7 +234713,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -231160,7 +234824,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -231213,8 +234877,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -231245,8 +234909,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -231321,8 +234985,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -231344,7 +235008,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -231578,7 +235242,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -231706,8 +235370,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -231915,8 +235579,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -231933,6 +235600,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -231962,8 +235634,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -232008,7 +235680,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -232021,8 +235697,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -232063,7 +235739,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -232170,7 +235850,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -232223,8 +235903,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -232255,8 +235935,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -232331,8 +236011,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -232354,7 +236034,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -232588,7 +236268,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -232716,8 +236396,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -232925,6 +236605,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -232941,8 +236626,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -232972,8 +236660,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -233018,7 +236706,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -233031,8 +236723,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -233073,7 +236765,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -233180,7 +236876,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -233233,8 +236929,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -233265,8 +236961,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -233341,8 +237037,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -233364,7 +237060,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -233598,7 +237294,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -233726,8 +237422,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -233935,6 +237631,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -233951,8 +237652,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -233982,8 +237686,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -234028,7 +237732,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -234041,8 +237749,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -234083,7 +237791,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -234190,7 +237902,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -234243,8 +237955,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -234275,8 +237987,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -234351,8 +238063,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -234374,7 +238086,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -234608,7 +238320,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -234736,8 +238448,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -234945,6 +238657,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -234961,8 +238678,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -234992,8 +238712,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -235038,7 +238758,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -235051,8 +238775,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -235093,7 +238817,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -235200,7 +238928,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -235253,8 +238981,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -235285,8 +239013,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -235361,8 +239089,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -235384,7 +239112,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -235618,7 +239346,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -235746,8 +239474,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -235955,6 +239683,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -235971,8 +239704,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -236002,8 +239738,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -236048,7 +239784,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -236061,8 +239801,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -236103,7 +239843,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -236210,7 +239954,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -236263,8 +240007,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -236295,8 +240039,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -236371,8 +240115,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -236394,7 +240138,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -236628,7 +240372,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -236756,8 +240500,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -236965,6 +240709,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -236981,8 +240730,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -237012,8 +240764,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -237058,7 +240810,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -237071,8 +240827,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -237113,7 +240869,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -237220,7 +240980,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -237273,8 +241033,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -237305,8 +241065,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -237381,8 +241141,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -237404,7 +241164,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -237638,7 +241398,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -237766,8 +241526,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -237975,8 +241735,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -237993,6 +241756,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -238022,8 +241790,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -238068,7 +241836,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -238081,8 +241853,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -238123,7 +241895,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -238230,7 +242006,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -238283,8 +242059,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -238315,8 +242091,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -238391,8 +242167,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -238414,7 +242190,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -238648,7 +242424,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -238776,8 +242552,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -238985,6 +242761,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -239001,8 +242782,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -239032,8 +242816,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -239078,7 +242862,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -239091,8 +242879,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -239133,7 +242921,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -239240,7 +243032,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -239293,8 +243085,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -239325,8 +243117,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -239401,8 +243193,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -239424,7 +243216,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -239658,7 +243450,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -239786,8 +243578,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -239995,8 +243787,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -240013,6 +243808,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -240042,8 +243842,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -240088,7 +243888,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -240101,8 +243905,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -240143,7 +243947,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -240250,7 +244058,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -240303,8 +244111,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -240335,8 +244143,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -240411,8 +244219,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -240434,7 +244242,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -240668,7 +244476,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -240796,8 +244604,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -241005,8 +244813,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -241023,6 +244834,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -241052,8 +244868,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -241098,7 +244914,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -241111,8 +244931,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -241153,7 +244973,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -241260,7 +245084,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -241313,8 +245137,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -241345,8 +245169,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -241421,8 +245245,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -241444,7 +245268,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -241678,7 +245502,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -241806,8 +245630,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -242015,6 +245839,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -242031,8 +245860,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -242062,8 +245894,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -242108,7 +245940,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -242121,8 +245957,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -242163,7 +245999,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -242270,7 +246110,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -242323,8 +246163,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -242355,8 +246195,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -242431,8 +246271,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -242454,7 +246294,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -242688,7 +246528,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -242816,8 +246656,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -243025,6 +246865,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -243041,8 +246886,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -243072,8 +246920,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -243118,7 +246966,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -243131,8 +246983,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -243173,7 +247025,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -243280,7 +247136,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -243333,8 +247189,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -243365,8 +247221,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -243441,8 +247297,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -243464,7 +247320,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -243698,7 +247554,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -243826,8 +247682,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -244035,6 +247891,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -244051,8 +247912,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -244082,8 +247946,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -244128,7 +247992,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -244141,8 +248009,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -244183,7 +248051,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -244290,7 +248162,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -244343,8 +248215,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -244375,8 +248247,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -244451,8 +248323,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -244474,7 +248346,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -244708,7 +248580,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -244836,8 +248708,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -245045,6 +248917,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -245061,8 +248938,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -245092,8 +248972,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -245138,7 +249018,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -245151,8 +249035,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -245193,7 +249077,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -245300,7 +249188,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -245353,8 +249241,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -245385,8 +249273,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -245461,8 +249349,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -245484,7 +249372,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -245718,7 +249606,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -245846,8 +249734,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -246055,6 +249943,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -246071,8 +249964,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -246102,8 +249998,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -246148,7 +250044,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -246161,8 +250061,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -246203,7 +250103,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -246310,7 +250214,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -246363,8 +250267,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -246395,8 +250299,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -246471,8 +250375,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -246494,7 +250398,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -246728,7 +250632,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -246856,8 +250760,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -247065,8 +250969,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -247083,6 +250990,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -247112,8 +251024,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -247158,7 +251070,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -247171,8 +251087,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -247213,7 +251129,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -247320,7 +251240,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -247373,8 +251293,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -247405,8 +251325,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -247481,8 +251401,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -247504,7 +251424,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -247738,7 +251658,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -247866,8 +251786,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -248075,6 +251995,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -248091,8 +252016,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -248122,8 +252050,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -248168,7 +252096,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -248181,8 +252113,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -248223,7 +252155,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -248330,7 +252266,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -248383,8 +252319,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -248415,8 +252351,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -248491,8 +252427,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -248514,7 +252450,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -248748,7 +252684,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -248876,8 +252812,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -249085,8 +253021,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -249103,6 +253042,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -249132,8 +253076,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -249178,7 +253122,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -249191,8 +253139,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -249233,7 +253181,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -249340,7 +253292,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -249393,8 +253345,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -249425,8 +253377,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -249501,8 +253453,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -249524,7 +253476,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -249758,7 +253710,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -249886,8 +253838,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -250095,8 +254047,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -250113,6 +254068,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -250142,8 +254102,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -250188,7 +254148,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -250201,8 +254165,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -250243,7 +254207,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -250350,7 +254318,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -250403,8 +254371,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -250435,8 +254403,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -250511,8 +254479,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -250534,7 +254502,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -250768,7 +254736,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -250896,8 +254864,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -251105,6 +255073,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -251121,8 +255094,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -251152,8 +255128,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -251198,7 +255174,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -251211,8 +255191,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -251253,7 +255233,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -251360,7 +255344,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -251413,8 +255397,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -251445,8 +255429,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -251521,8 +255505,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -251544,7 +255528,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -251778,7 +255762,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -251906,8 +255890,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -252115,6 +256099,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -252131,8 +256120,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -252162,8 +256154,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -252208,7 +256200,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -252221,8 +256217,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -252263,7 +256259,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -252370,7 +256370,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -252423,8 +256423,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -252455,8 +256455,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -252531,8 +256531,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -252554,7 +256554,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -252788,7 +256788,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -252916,8 +256916,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -253125,6 +257125,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -253141,8 +257146,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -253172,8 +257180,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -253218,7 +257226,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -253231,8 +257243,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -253273,7 +257285,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -253380,7 +257396,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -253433,8 +257449,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -253465,8 +257481,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -253541,8 +257557,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -253564,7 +257580,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -253798,7 +257814,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -253926,8 +257942,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -254135,6 +258151,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -254151,8 +258172,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -254182,8 +258206,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -254228,7 +258252,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -254241,8 +258269,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -254283,7 +258311,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -254390,7 +258422,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -254443,8 +258475,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -254475,8 +258507,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -254551,8 +258583,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -254574,7 +258606,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -254808,7 +258840,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -254936,8 +258968,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -255145,6 +259177,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -255161,8 +259198,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -255192,8 +259232,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -255238,7 +259278,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -255251,8 +259295,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -255293,7 +259337,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -255400,7 +259448,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -255453,8 +259501,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -255485,8 +259533,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -255561,8 +259609,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -255584,7 +259632,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -255818,7 +259866,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -255946,8 +259994,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -256155,8 +260203,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -256173,6 +260224,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -256202,8 +260258,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -256248,7 +260304,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -256261,8 +260321,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -256303,7 +260363,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -256410,7 +260474,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -256463,8 +260527,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -256495,8 +260559,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -256571,8 +260635,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -256594,7 +260658,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -256828,7 +260892,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -256956,8 +261020,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -257165,6 +261229,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -257181,8 +261250,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -257212,8 +261284,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -257258,7 +261330,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -257271,8 +261347,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -257313,7 +261389,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -257420,7 +261500,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -257473,8 +261553,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -257505,8 +261585,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -257581,8 +261661,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -257604,7 +261684,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -257838,7 +261918,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -257966,8 +262046,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -258175,8 +262255,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -258193,6 +262276,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -258222,8 +262310,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -258268,7 +262356,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -258281,8 +262373,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -258323,7 +262415,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -258430,7 +262526,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -258483,8 +262579,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -258515,8 +262611,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -258591,8 +262687,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -258614,7 +262710,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -258848,7 +262944,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -258976,8 +263072,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -259185,8 +263281,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -259203,6 +263302,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -259232,8 +263336,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -259278,7 +263382,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -259291,8 +263399,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -259333,7 +263441,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -259440,7 +263552,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -259493,8 +263605,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -259525,8 +263637,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -259601,8 +263713,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -259624,7 +263736,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -259858,7 +263970,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -259986,8 +264098,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -260195,6 +264307,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -260211,8 +264328,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -260242,8 +264362,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -260288,7 +264408,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -260301,8 +264425,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -260343,7 +264467,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -260450,7 +264578,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -260503,8 +264631,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -260535,8 +264663,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -260611,8 +264739,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -260634,7 +264762,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -260868,7 +264996,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -260996,8 +265124,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -261205,6 +265333,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -261221,8 +265354,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -261252,8 +265388,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -261298,7 +265434,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -261311,8 +265451,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -261353,7 +265493,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -261460,7 +265604,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -261513,8 +265657,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -261545,8 +265689,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -261621,8 +265765,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -261644,7 +265788,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -261878,7 +266022,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -262006,8 +266150,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -262215,6 +266359,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -262231,8 +266380,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -262262,8 +266414,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -262308,7 +266460,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -262321,8 +266477,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -262363,7 +266519,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -262470,7 +266630,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -262523,8 +266683,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -262555,8 +266715,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -262631,8 +266791,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -262654,7 +266814,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -262888,7 +267048,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -263016,8 +267176,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -263225,6 +267385,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -263241,8 +267406,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -263272,8 +267440,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -263318,7 +267486,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -263331,8 +267503,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -263373,7 +267545,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -263480,7 +267656,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -263533,8 +267709,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -263565,8 +267741,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -263641,8 +267817,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -263664,7 +267840,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -263898,7 +268074,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -264026,8 +268202,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -264235,6 +268411,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -264251,8 +268432,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -264282,8 +268466,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -264328,7 +268512,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -264341,8 +268529,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -264383,7 +268571,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -264490,7 +268682,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -264543,8 +268735,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -264575,8 +268767,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -264651,8 +268843,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -264674,7 +268866,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -264908,7 +269100,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -265036,8 +269228,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -265245,8 +269437,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -265263,6 +269458,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -265292,8 +269492,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -265338,7 +269538,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -265351,8 +269555,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -265393,7 +269597,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -265500,7 +269708,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -265553,8 +269761,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -265585,8 +269793,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -265661,8 +269869,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -265684,7 +269892,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -265918,7 +270126,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -266046,8 +270254,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -266255,6 +270463,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -266271,8 +270484,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -266302,8 +270518,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -266348,7 +270564,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -266361,8 +270581,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -266403,7 +270623,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -266510,7 +270734,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -266563,8 +270787,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -266595,8 +270819,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -266671,8 +270895,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -266694,7 +270918,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -266928,7 +271152,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -267056,8 +271280,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -267265,8 +271489,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -267283,6 +271510,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -267312,8 +271544,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -267358,7 +271590,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -267371,8 +271607,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -267413,7 +271649,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -267520,7 +271760,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -267573,8 +271813,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -267605,8 +271845,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -267681,8 +271921,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -267704,7 +271944,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -267938,7 +272178,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -268066,8 +272306,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -268275,8 +272515,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -268293,6 +272536,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -268322,8 +272570,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -268368,7 +272616,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -268381,8 +272633,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -268423,7 +272675,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -268530,7 +272786,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -268583,8 +272839,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -268615,8 +272871,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -268691,8 +272947,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -268714,7 +272970,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -268948,7 +273204,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -269076,8 +273332,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -269285,6 +273541,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -269301,8 +273562,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -269332,8 +273596,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -269378,7 +273642,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -269391,8 +273659,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -269433,7 +273701,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -269540,7 +273812,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -269593,8 +273865,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -269625,8 +273897,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -269701,8 +273973,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -269724,7 +273996,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -269958,7 +274230,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -270086,8 +274358,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -270295,6 +274567,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -270311,8 +274588,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -270342,8 +274622,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -270388,7 +274668,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -270401,8 +274685,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -270443,7 +274727,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -270550,7 +274838,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -270603,8 +274891,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -270635,8 +274923,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -270711,8 +274999,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -270734,7 +275022,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -270968,7 +275256,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -271096,8 +275384,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -271305,6 +275593,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -271321,8 +275614,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -271352,8 +275648,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -271398,7 +275694,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -271411,8 +275711,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -271453,7 +275753,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -271560,7 +275864,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -271613,8 +275917,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -271645,8 +275949,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -271721,8 +276025,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -271744,7 +276048,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -271978,7 +276282,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -272106,8 +276410,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -272315,6 +276619,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -272331,8 +276640,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -272362,8 +276674,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -272408,7 +276720,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -272421,8 +276737,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -272463,7 +276779,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -272570,7 +276890,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -272623,8 +276943,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -272655,8 +276975,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -272731,8 +277051,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -272754,7 +277074,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -272988,7 +277308,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -273116,8 +277436,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -273325,6 +277645,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -273341,8 +277666,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -273372,8 +277700,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -273418,7 +277746,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -273431,8 +277763,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -273473,7 +277805,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -273580,7 +277916,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -273633,8 +277969,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -273665,8 +278001,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -273741,8 +278077,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -273764,7 +278100,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -273998,7 +278334,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -274126,8 +278462,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -274335,8 +278671,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -274353,6 +278692,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -274382,8 +278726,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -274428,7 +278772,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -274441,8 +278789,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -274483,7 +278831,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -274590,7 +278942,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -274643,8 +278995,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -274675,8 +279027,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -274751,8 +279103,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -274774,7 +279126,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -275008,7 +279360,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -275136,8 +279488,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -275345,6 +279697,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -275361,8 +279718,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -275392,8 +279752,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -275438,7 +279798,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -275451,8 +279815,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -275493,7 +279857,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -275600,7 +279968,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -275653,8 +280021,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -275685,8 +280053,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -275761,8 +280129,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -275784,7 +280152,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -276018,7 +280386,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -276146,8 +280514,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -276355,8 +280723,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -276373,6 +280744,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -276402,8 +280778,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -276448,7 +280824,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -276461,8 +280841,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -276503,7 +280883,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -276610,7 +280994,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -276663,8 +281047,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -276695,8 +281079,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -276771,8 +281155,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -276794,7 +281178,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -277028,7 +281412,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -277156,8 +281540,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -277365,8 +281749,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -277383,6 +281770,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -277412,8 +281804,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -277458,7 +281850,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -277471,8 +281867,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -277513,7 +281909,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -277620,7 +282020,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -277673,8 +282073,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -277705,8 +282105,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -277781,8 +282181,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -277804,7 +282204,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -278038,7 +282438,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -278166,8 +282566,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -278375,6 +282775,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -278391,8 +282796,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -278422,8 +282830,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -278468,7 +282876,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -278481,8 +282893,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -278523,7 +282935,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -278630,7 +283046,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -278683,8 +283099,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -278715,8 +283131,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -278791,8 +283207,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -278814,7 +283230,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -279048,7 +283464,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -279176,8 +283592,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -279385,6 +283801,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -279401,8 +283822,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -279432,8 +283856,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -279478,7 +283902,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -279491,8 +283919,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -279533,7 +283961,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -279640,7 +284072,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -279693,8 +284125,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -279725,8 +284157,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -279801,8 +284233,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -279824,7 +284256,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -280058,7 +284490,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -280186,8 +284618,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -280395,6 +284827,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -280411,8 +284848,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -280442,8 +284882,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -280488,7 +284928,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -280501,8 +284945,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -280543,7 +284987,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -280650,7 +285098,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -280703,8 +285151,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -280735,8 +285183,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -280811,8 +285259,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -280834,7 +285282,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -281068,7 +285516,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -281196,8 +285644,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -281405,6 +285853,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -281421,8 +285874,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -281452,8 +285908,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -281498,7 +285954,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -281511,8 +285971,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -281553,7 +286013,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -281660,7 +286124,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -281713,8 +286177,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -281745,8 +286209,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -281821,8 +286285,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -281844,7 +286308,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -282078,7 +286542,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -282206,8 +286670,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -282415,6 +286879,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -282431,8 +286900,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -282462,8 +286934,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -282508,7 +286980,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -282521,8 +286997,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -282563,7 +287039,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -282670,7 +287150,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -282723,8 +287203,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -282755,8 +287235,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -282831,8 +287311,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -282854,7 +287334,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -283088,7 +287568,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -283216,8 +287696,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -283425,8 +287905,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -283443,6 +287926,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -283472,8 +287960,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -283518,7 +288006,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -283531,8 +288023,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -283573,7 +288065,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -283680,7 +288176,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -283733,8 +288229,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -283765,8 +288261,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -283841,8 +288337,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -283864,7 +288360,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -284098,7 +288594,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -284226,8 +288722,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -284435,6 +288931,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -284451,8 +288952,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -284482,8 +288986,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -284528,7 +289032,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -284541,8 +289049,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -284583,7 +289091,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -284690,7 +289202,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -284743,8 +289255,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -284775,8 +289287,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -284851,8 +289363,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -284874,7 +289386,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -285108,7 +289620,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -285236,8 +289748,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -285445,8 +289957,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -285463,6 +289978,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -285492,8 +290012,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -285538,7 +290058,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -285551,8 +290075,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -285593,7 +290117,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -285700,7 +290228,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -285753,8 +290281,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -285785,8 +290313,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -285861,8 +290389,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -285884,7 +290412,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -286118,7 +290646,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -286246,8 +290774,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -286455,8 +290983,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -286473,6 +291004,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -286502,8 +291038,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -286548,7 +291084,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -286561,8 +291101,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -286603,7 +291143,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -286710,7 +291254,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -286763,8 +291307,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -286795,8 +291339,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -286871,8 +291415,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -286894,7 +291438,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -287128,7 +291672,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -287256,8 +291800,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -287465,6 +292009,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -287481,8 +292030,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -287512,8 +292064,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -287558,7 +292110,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -287571,8 +292127,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -287613,7 +292169,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -287720,7 +292280,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -287773,8 +292333,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -287805,8 +292365,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -287881,8 +292441,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -287904,7 +292464,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -288138,7 +292698,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -288266,8 +292826,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -288475,6 +293035,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -288491,8 +293056,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -288522,8 +293090,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -288568,7 +293136,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -288581,8 +293153,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -288623,7 +293195,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -288730,7 +293306,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -288783,8 +293359,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -288815,8 +293391,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -288891,8 +293467,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -288914,7 +293490,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -289148,7 +293724,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -289276,8 +293852,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -289485,6 +294061,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -289501,8 +294082,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -289532,8 +294116,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -289578,7 +294162,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -289591,8 +294179,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -289633,7 +294221,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -289740,7 +294332,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -289793,8 +294385,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -289825,8 +294417,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -289901,8 +294493,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -289924,7 +294516,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -290158,7 +294750,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -290286,8 +294878,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -290495,6 +295087,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -290511,8 +295108,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -290542,8 +295142,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -290588,7 +295188,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -290601,8 +295205,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -290643,7 +295247,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -290750,7 +295358,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -290803,8 +295411,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -290835,8 +295443,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -290911,8 +295519,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -290934,7 +295542,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -291168,7 +295776,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -291296,8 +295904,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -291505,6 +296113,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -291521,8 +296134,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -291552,8 +296168,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -291598,7 +296214,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -291611,8 +296231,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -291653,7 +296273,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -291760,7 +296384,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -291813,8 +296437,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -291845,8 +296469,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -291921,8 +296545,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -291944,7 +296568,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -292178,7 +296802,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -292306,8 +296930,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -292515,8 +297139,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -292533,6 +297160,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -292562,8 +297194,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -292608,7 +297240,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -292621,8 +297257,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -292663,7 +297299,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -292770,7 +297410,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -292823,8 +297463,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -292855,8 +297495,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -292931,8 +297571,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -292954,7 +297594,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -293188,7 +297828,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -293316,8 +297956,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -293525,6 +298165,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -293541,8 +298186,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -293572,8 +298220,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -293618,7 +298266,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -293631,8 +298283,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -293673,7 +298325,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -293780,7 +298436,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -293833,8 +298489,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -293865,8 +298521,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -293941,8 +298597,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -293964,7 +298620,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -294198,7 +298854,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -294326,8 +298982,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -294535,8 +299191,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -294553,6 +299212,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -294582,8 +299246,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -294628,7 +299292,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -294641,8 +299309,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -294683,7 +299351,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -294790,7 +299462,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -294843,8 +299515,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -294875,8 +299547,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -294951,8 +299623,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -294974,7 +299646,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -295208,7 +299880,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -295336,8 +300008,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -295545,8 +300217,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -295563,6 +300238,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -295592,8 +300272,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -295638,7 +300318,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -295651,8 +300335,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -295693,7 +300377,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -295800,7 +300488,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -295853,8 +300541,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -295885,8 +300573,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -295961,8 +300649,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -295984,7 +300672,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -296218,7 +300906,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -296346,8 +301034,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -296555,6 +301243,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -296571,8 +301264,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -296602,8 +301298,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -296648,7 +301344,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -296661,8 +301361,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -296703,7 +301403,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -296810,7 +301514,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -296863,8 +301567,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -296895,8 +301599,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -296971,8 +301675,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -296994,7 +301698,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -297228,7 +301932,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -297356,8 +302060,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -297565,6 +302269,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -297581,8 +302290,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -297612,8 +302324,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -297658,7 +302370,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -297671,8 +302387,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -297713,7 +302429,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -297820,7 +302540,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -297873,8 +302593,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -297905,8 +302625,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -297981,8 +302701,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -298004,7 +302724,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -298238,7 +302958,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -298366,8 +303086,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -298575,6 +303295,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -298591,8 +303316,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -298622,8 +303350,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -298668,7 +303396,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -298681,8 +303413,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -298723,7 +303455,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -298830,7 +303566,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -298883,8 +303619,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -298915,8 +303651,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -298991,8 +303727,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -299014,7 +303750,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -299248,7 +303984,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -299376,8 +304112,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -299585,6 +304321,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -299601,8 +304342,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -299632,8 +304376,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -299678,7 +304422,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -299691,8 +304439,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -299733,7 +304481,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -299840,7 +304592,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -299893,8 +304645,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -299925,8 +304677,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -300001,8 +304753,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -300024,7 +304776,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -300258,7 +305010,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -300386,8 +305138,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -300595,6 +305347,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -300611,8 +305368,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -300642,8 +305402,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -300688,7 +305448,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -300701,8 +305465,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -300743,7 +305507,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -300850,7 +305618,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -300903,8 +305671,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -300935,8 +305703,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -301011,8 +305779,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -301034,7 +305802,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -301268,7 +306036,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -301396,8 +306164,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -301605,8 +306373,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -301623,6 +306394,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -301652,8 +306428,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -301698,7 +306474,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -301711,8 +306491,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -301753,7 +306533,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -301860,7 +306644,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -301913,8 +306697,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -301945,8 +306729,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -302021,8 +306805,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -302044,7 +306828,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -302278,7 +307062,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -302406,8 +307190,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -302615,6 +307399,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -302631,8 +307420,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -302662,8 +307454,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -302708,7 +307500,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -302721,8 +307517,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -302763,7 +307559,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -302870,7 +307670,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -302923,8 +307723,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -302955,8 +307755,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -303031,8 +307831,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -303054,7 +307854,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -303288,7 +308088,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -303416,8 +308216,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -303625,8 +308425,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -303643,6 +308446,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -303672,8 +308480,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -303718,7 +308526,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -303731,8 +308543,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -303773,7 +308585,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -303880,7 +308696,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -303933,8 +308749,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -303965,8 +308781,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -304041,8 +308857,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -304064,7 +308880,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -304298,7 +309114,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -304426,8 +309242,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -304635,8 +309451,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -304653,6 +309472,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -304682,8 +309506,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -304728,7 +309552,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -304741,8 +309569,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -304783,7 +309611,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -304890,7 +309722,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -304943,8 +309775,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -304975,8 +309807,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -305051,8 +309883,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -305074,7 +309906,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -305308,7 +310140,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -305436,8 +310268,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -305645,6 +310477,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -305661,8 +310498,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -305692,8 +310532,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -305738,7 +310578,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -305751,8 +310595,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -305793,7 +310637,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -305900,7 +310748,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -305953,8 +310801,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -305985,8 +310833,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -306061,8 +310909,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -306084,7 +310932,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -306318,7 +311166,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -306446,8 +311294,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -306655,6 +311503,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -306671,8 +311524,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -306702,8 +311558,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -306748,7 +311604,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -306761,8 +311621,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -306803,7 +311663,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -306910,7 +311774,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -306963,8 +311827,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -306995,8 +311859,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -307071,8 +311935,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -307094,7 +311958,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -307328,7 +312192,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -307456,8 +312320,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -307665,6 +312529,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -307681,8 +312550,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -307712,8 +312584,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -307758,7 +312630,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -307771,8 +312647,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -307813,7 +312689,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -307920,7 +312800,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -307973,8 +312853,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -308005,8 +312885,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -308081,8 +312961,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -308104,7 +312984,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -308338,7 +313218,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -308466,8 +313346,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -308675,6 +313555,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -308691,8 +313576,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -308722,8 +313610,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -308768,7 +313656,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -308781,8 +313673,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -308823,7 +313715,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -308930,7 +313826,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -308983,8 +313879,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -309015,8 +313911,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -309091,8 +313987,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -309114,7 +314010,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -309348,7 +314244,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -309476,8 +314372,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -309685,6 +314581,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -309701,8 +314602,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -309732,8 +314636,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -309778,7 +314682,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -309791,8 +314699,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -309833,7 +314741,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -309940,7 +314852,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -309993,8 +314905,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -310025,8 +314937,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -310101,8 +315013,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -310124,7 +315036,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -310358,7 +315270,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -310486,8 +315398,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -310695,8 +315607,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -310713,6 +315628,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -310742,8 +315662,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -310788,7 +315708,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -310801,8 +315725,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -310843,7 +315767,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -310950,7 +315878,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -311003,8 +315931,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -311035,8 +315963,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -311111,8 +316039,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -311134,7 +316062,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -311368,7 +316296,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -311496,8 +316424,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -311705,6 +316633,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -311721,8 +316654,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -311752,8 +316688,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -311798,7 +316734,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -311811,8 +316751,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -311853,7 +316793,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -311960,7 +316904,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -312013,8 +316957,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -312045,8 +316989,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -312121,8 +317065,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -312144,7 +317088,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -312378,7 +317322,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -312506,8 +317450,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -312715,8 +317659,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -312733,6 +317680,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -312762,8 +317714,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -312808,7 +317760,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -312821,8 +317777,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -312863,7 +317819,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -312970,7 +317930,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -313023,8 +317983,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -313055,8 +318015,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -313131,8 +318091,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -313154,7 +318114,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -313388,7 +318348,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -313516,8 +318476,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -313725,8 +318685,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -313743,6 +318706,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -313772,8 +318740,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -313818,7 +318786,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -313831,8 +318803,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -313873,7 +318845,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -313980,7 +318956,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -314033,8 +319009,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -314065,8 +319041,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -314141,8 +319117,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -314164,7 +319140,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -314398,7 +319374,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -314526,8 +319502,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -314735,6 +319711,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -314751,8 +319732,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -314782,8 +319766,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -314828,7 +319812,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -314841,8 +319829,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -314883,7 +319871,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -314990,7 +319982,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -315043,8 +320035,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -315075,8 +320067,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -315151,8 +320143,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -315174,7 +320166,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -315408,7 +320400,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -315536,8 +320528,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -315745,6 +320737,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -315761,8 +320758,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -315792,8 +320792,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -315838,7 +320838,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -315851,8 +320855,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -315893,7 +320897,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -316000,7 +321008,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -316053,8 +321061,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -316085,8 +321093,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -316161,8 +321169,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -316184,7 +321192,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -316418,7 +321426,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -316546,8 +321554,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -316755,6 +321763,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -316771,8 +321784,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -316802,8 +321818,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -316848,7 +321864,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -316861,8 +321881,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -316903,7 +321923,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -317010,7 +322034,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -317063,8 +322087,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -317095,8 +322119,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -317171,8 +322195,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -317194,7 +322218,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -317428,7 +322452,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -317556,8 +322580,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -317765,6 +322789,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -317781,8 +322810,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -317812,8 +322844,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -317858,7 +322890,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -317871,8 +322907,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -317913,7 +322949,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -318020,7 +323060,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -318073,8 +323113,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -318105,8 +323145,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -318181,8 +323221,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -318204,7 +323244,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -318438,7 +323478,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -318566,8 +323606,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -318775,6 +323815,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -318791,8 +323836,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -318822,8 +323870,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -318868,7 +323916,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -318881,8 +323933,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -318923,7 +323975,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -319030,7 +324086,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -319083,8 +324139,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -319115,8 +324171,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -319191,8 +324247,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -319214,7 +324270,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -319448,7 +324504,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -319576,8 +324632,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -319785,8 +324841,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -319803,6 +324862,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -319832,8 +324896,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -319878,7 +324942,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -319891,8 +324959,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -319933,7 +325001,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -320040,7 +325112,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -320093,8 +325165,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -320125,8 +325197,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -320201,8 +325273,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -320224,7 +325296,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -320458,7 +325530,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -320586,8 +325658,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -320795,6 +325867,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -320811,8 +325888,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -320842,8 +325922,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -320888,7 +325968,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -320901,8 +325985,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -320943,7 +326027,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -321050,7 +326138,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -321103,8 +326191,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -321135,8 +326223,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -321211,8 +326299,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -321234,7 +326322,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -321468,7 +326556,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -321596,8 +326684,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -321805,8 +326893,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -321823,6 +326914,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -321852,8 +326948,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -321898,7 +326994,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -321911,8 +327011,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -321953,7 +327053,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -322060,7 +327164,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -322113,8 +327217,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -322145,8 +327249,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -322221,8 +327325,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -322244,7 +327348,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -322478,7 +327582,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -322606,8 +327710,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -322815,8 +327919,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -322833,6 +327940,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -322862,8 +327974,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -322908,7 +328020,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -322921,8 +328037,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -322963,7 +328079,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -323070,7 +328190,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -323123,8 +328243,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -323155,8 +328275,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -323231,8 +328351,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -323254,7 +328374,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -323488,7 +328608,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -323616,8 +328736,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -323825,6 +328945,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -323841,8 +328966,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -323872,8 +329000,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -323918,7 +329046,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -323931,8 +329063,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -323973,7 +329105,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -324080,7 +329216,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -324133,8 +329269,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -324165,8 +329301,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -324241,8 +329377,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -324264,7 +329400,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -324498,7 +329634,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -324626,8 +329762,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -324835,6 +329971,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -324851,8 +329992,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -324882,8 +330026,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -324928,7 +330072,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -324941,8 +330089,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -324983,7 +330131,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -325090,7 +330242,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -325143,8 +330295,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -325175,8 +330327,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -325251,8 +330403,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -325274,7 +330426,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -325508,7 +330660,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -325636,8 +330788,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -325845,6 +330997,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -325861,8 +331018,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -325892,8 +331052,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -325938,7 +331098,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -325951,8 +331115,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -325993,7 +331157,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -326100,7 +331268,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -326153,8 +331321,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -326185,8 +331353,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -326261,8 +331429,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -326284,7 +331452,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -326518,7 +331686,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -326646,8 +331814,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -326855,6 +332023,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -326871,8 +332044,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -326902,8 +332078,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -326948,7 +332124,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -326961,8 +332141,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -327003,7 +332183,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -327110,7 +332294,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -327163,8 +332347,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -327195,8 +332379,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -327271,8 +332455,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -327294,7 +332478,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -327528,7 +332712,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -327656,8 +332840,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -327865,8 +333049,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -327883,6 +333070,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -327912,8 +333104,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -327958,7 +333150,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -327971,8 +333167,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -328013,7 +333209,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -328120,7 +333320,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -328173,8 +333373,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -328205,8 +333405,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -328281,8 +333481,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -328304,7 +333504,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -328538,7 +333738,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -328666,8 +333866,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -328875,8 +334075,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -328893,6 +334096,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -328922,8 +334130,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -328968,7 +334176,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -328981,8 +334193,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -329023,7 +334235,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -329130,7 +334346,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -329183,8 +334399,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -329215,8 +334431,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -329291,8 +334507,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -329314,7 +334530,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -329548,7 +334764,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -329676,8 +334892,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -329885,8 +335101,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -329903,6 +335122,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -329932,8 +335156,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -329978,7 +335202,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -329991,8 +335219,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -330033,7 +335261,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -330140,7 +335372,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -330193,8 +335425,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -330225,8 +335457,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -330301,8 +335533,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -330324,7 +335556,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -330558,7 +335790,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -330686,8 +335918,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -330895,8 +336127,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -330913,6 +336148,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -330942,8 +336182,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -330988,7 +336228,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -331001,8 +336245,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -331043,7 +336287,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -331150,7 +336398,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -331203,8 +336451,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -331235,8 +336483,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -331311,8 +336559,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -331334,7 +336582,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -331568,7 +336816,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -331696,8 +336944,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -331905,6 +337153,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -331921,8 +337174,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -331952,8 +337208,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -331998,7 +337254,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -332011,8 +337271,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -332053,7 +337313,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -332160,7 +337424,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -332213,8 +337477,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -332245,8 +337509,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -332321,8 +337585,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -332344,7 +337608,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -332578,7 +337842,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -332706,8 +337970,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -332915,6 +338179,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -332931,8 +338200,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -332962,8 +338234,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -333008,7 +338280,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -333021,8 +338297,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -333063,7 +338339,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -333170,7 +338450,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -333223,8 +338503,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -333255,8 +338535,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -333331,8 +338611,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -333354,7 +338634,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -333588,7 +338868,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -333716,8 +338996,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -333925,6 +339205,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -333941,8 +339226,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -333972,8 +339260,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -334018,7 +339306,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -334031,8 +339323,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -334073,7 +339365,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -334180,7 +339476,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -334233,8 +339529,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -334265,8 +339561,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -334341,8 +339637,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -334364,7 +339660,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -334598,7 +339894,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -334726,8 +340022,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -334935,8 +340231,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -334953,6 +340252,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -334982,8 +340286,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -335028,7 +340332,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -335041,8 +340349,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -335083,7 +340391,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -335190,7 +340502,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -335243,8 +340555,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -335275,8 +340587,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -335351,8 +340663,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -335374,7 +340686,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -335608,7 +340920,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -335736,8 +341048,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -335945,6 +341257,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -335961,8 +341278,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -335992,8 +341312,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -336038,7 +341358,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -336051,8 +341375,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -336093,7 +341417,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -336200,7 +341528,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -336253,8 +341581,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -336285,8 +341613,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -336361,8 +341689,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -336384,7 +341712,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -336618,7 +341946,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -336746,8 +342074,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -336955,8 +342283,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -336973,6 +342304,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -337002,8 +342338,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -337048,7 +342384,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -337061,8 +342401,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -337103,7 +342443,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -337210,7 +342554,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -337263,8 +342607,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -337295,8 +342639,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -337371,8 +342715,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -337394,7 +342738,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -337628,7 +342972,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -337756,8 +343100,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -337965,8 +343309,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -337983,6 +343330,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -338012,8 +343364,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -338058,7 +343410,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -338071,8 +343427,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -338113,7 +343469,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -338220,7 +343580,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -338273,8 +343633,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -338305,8 +343665,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -338381,8 +343741,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -338404,7 +343764,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -338638,7 +343998,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -338766,8 +344126,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -338975,6 +344335,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -338991,8 +344356,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -339022,8 +344390,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -339068,7 +344436,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -339081,8 +344453,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -339123,7 +344495,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -339230,7 +344606,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -339283,8 +344659,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -339315,8 +344691,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -339391,8 +344767,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -339414,7 +344790,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -339648,7 +345024,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -339776,8 +345152,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -339985,6 +345361,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -340001,8 +345382,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -340032,8 +345416,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -340078,7 +345462,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -340091,8 +345479,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -340133,7 +345521,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -340240,7 +345632,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -340293,8 +345685,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -340325,8 +345717,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -340401,8 +345793,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -340424,7 +345816,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -340658,7 +346050,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -340786,8 +346178,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -340995,6 +346387,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -341011,8 +346408,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -341042,8 +346442,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -341088,7 +346488,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -341101,8 +346505,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -341143,7 +346547,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -341250,7 +346658,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -341303,8 +346711,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -341335,8 +346743,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -341411,8 +346819,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -341434,7 +346842,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -341668,7 +347076,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -341796,8 +347204,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -342005,6 +347413,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -342021,8 +347434,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -342052,8 +347468,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -342098,7 +347514,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -342111,8 +347531,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -342153,7 +347573,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -342260,7 +347684,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -342313,8 +347737,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -342345,8 +347769,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -342421,8 +347845,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -342444,7 +347868,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -342678,7 +348102,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -342806,8 +348230,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -343015,6 +348439,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -343031,8 +348460,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -343062,8 +348494,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -343108,7 +348540,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -343121,8 +348557,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -343163,7 +348599,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -343270,7 +348710,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -343323,8 +348763,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -343355,8 +348795,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -343431,8 +348871,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -343454,7 +348894,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -343688,7 +349128,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -343816,8 +349256,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -344025,8 +349465,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -344043,6 +349486,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -344072,8 +349520,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -344118,7 +349566,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -344131,8 +349583,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -344173,7 +349625,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -344280,7 +349736,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -344333,8 +349789,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -344365,8 +349821,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -344441,8 +349897,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -344464,7 +349920,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -344698,7 +350154,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -344826,8 +350282,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -345035,8 +350491,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -345053,6 +350512,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -345082,8 +350546,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -345128,7 +350592,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -345141,8 +350609,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -345183,7 +350651,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -345290,7 +350762,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -345343,8 +350815,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -345375,8 +350847,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -345451,8 +350923,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -345474,7 +350946,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -345708,7 +351180,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -345836,8 +351308,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -346045,6 +351517,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -346061,8 +351538,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -346092,8 +351572,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -346138,7 +351618,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -346151,8 +351635,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -346193,7 +351677,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -346300,7 +351788,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -346353,8 +351841,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -346385,8 +351873,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -346461,8 +351949,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -346484,7 +351972,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -346718,7 +352206,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -346846,8 +352334,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -347055,6 +352543,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -347071,8 +352564,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -347102,8 +352598,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -347148,7 +352644,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -347161,8 +352661,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -347203,7 +352703,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -347310,7 +352814,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -347363,8 +352867,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -347395,8 +352899,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -347471,8 +352975,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -347494,7 +352998,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -347728,7 +353232,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -347856,8 +353360,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -348065,6 +353569,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -348081,8 +353590,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -348112,8 +353624,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -348158,7 +353670,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -348171,8 +353687,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -348213,7 +353729,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -348320,7 +353840,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -348373,8 +353893,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -348405,8 +353925,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -348481,8 +354001,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -348504,7 +354024,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -348738,7 +354258,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -348866,8 +354386,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -349075,8 +354595,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -349093,6 +354616,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -349122,8 +354650,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -349168,7 +354696,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -349181,8 +354713,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -349223,7 +354755,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -349330,7 +354866,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -349383,8 +354919,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -349415,8 +354951,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -349491,8 +355027,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -349514,7 +355050,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -349748,7 +355284,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -349876,8 +355412,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -350085,8 +355621,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -350103,6 +355642,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -350132,8 +355676,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -350178,7 +355722,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -350191,8 +355739,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -350233,7 +355781,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -350340,7 +355892,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -350393,8 +355945,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -350425,8 +355977,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -350501,8 +356053,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -350524,7 +356076,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -350758,7 +356310,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -350886,8 +356438,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -351095,6 +356647,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -351111,8 +356668,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -351142,8 +356702,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -351188,7 +356748,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -351201,8 +356765,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -351243,7 +356807,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -351350,7 +356918,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -351403,8 +356971,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -351435,8 +357003,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -351511,8 +357079,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -351534,7 +357102,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -351768,7 +357336,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -351896,8 +357464,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -352105,6 +357673,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -352121,8 +357694,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -352152,8 +357728,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -352198,7 +357774,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -352211,8 +357791,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -352253,7 +357833,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -352360,7 +357944,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -352413,8 +357997,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -352445,8 +358029,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -352521,8 +358105,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -352544,7 +358128,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -352778,7 +358362,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -352906,8 +358490,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -353115,6 +358699,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -353131,8 +358720,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -353162,8 +358754,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -353208,7 +358800,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -353221,8 +358817,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -353263,7 +358859,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -353370,7 +358970,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -353423,8 +359023,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -353455,8 +359055,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -353531,8 +359131,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -353554,7 +359154,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -353788,7 +359388,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -353916,8 +359516,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -354125,8 +359725,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, - {}, - {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -354143,6 +359746,11 @@ {}, {}, {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -354172,8 +359780,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -354218,7 +359826,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -354231,8 +359843,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -354273,7 +359885,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -354380,7 +359996,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -354433,8 +360049,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -354465,8 +360081,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, @@ -354541,8 +360157,8 @@ {}, { "techniqueID": "T1218.011", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "score": 8, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, {}, {}, @@ -354564,7 +360180,7 @@ {}, { "techniqueID": "T1003", - "score": 14, + "score": 18, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml" }, {}, @@ -354798,7 +360414,7 @@ {}, { "techniqueID": "T1036", - "score": 7, + "score": 8, "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" }, { @@ -354926,8 +360542,8 @@ {}, { "techniqueID": "T1003.001", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -355135,6 +360751,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml" }, {}, + { + "techniqueID": "T1136.003", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_new_federated_domain_added.yml" + }, {}, {}, {}, @@ -355151,8 +360772,11 @@ {}, {}, {}, - {}, - {}, + { + "techniqueID": "T1218.001", + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1070.005", "score": 1, @@ -355182,8 +360806,8 @@ {}, { "techniqueID": "T1078", - "score": 30, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 32, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, {}, {}, @@ -355228,7 +360852,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1218.010", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, {}, {}, {}, @@ -355241,8 +360869,8 @@ {}, { "techniqueID": "T1036.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -355283,7 +360911,11 @@ "score": 2, "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, - {}, + { + "techniqueID": "T1218.009", + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_regsvcs_with_no_command_line_arguments.yml" + }, {}, {}, { @@ -355390,7 +361022,7 @@ {}, { "techniqueID": "T1136", - "score": 4, + "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, @@ -355443,8 +361075,8 @@ {}, { "techniqueID": "T1003.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, {}, {}, @@ -355475,8 +361107,8 @@ {}, { "techniqueID": "T1556", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_sso_logon_errors.yml" }, {}, {}, diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv index 631eeb057a..07c183a57b 100644 --- a/docs/mitre-map/detections.csv +++ b/docs/mitre-map/detections.csv @@ -8803,7041 +8803,8801 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,26 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,26 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,24 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,24 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,22 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,22 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,20 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,20 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 T1192,No,-,26 T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,25 @@ -29919,7 +31679,14 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,11 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,11 T1049,No,-,14 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29928,7 +31695,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29937,7 +31711,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29946,7 +31727,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29955,7 +31743,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29964,7 +31759,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29973,7 +31775,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29982,7 +31791,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -29991,7 +31807,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30000,7 +31823,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30009,7 +31839,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30018,7 +31855,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30027,7 +31871,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30036,7 +31887,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30045,7 +31903,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30054,7 +31919,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30063,7 +31935,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30072,7 +31951,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30081,7 +31967,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30090,7 +31983,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30099,7 +31999,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30108,7 +32015,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30117,7 +32031,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30126,7 +32047,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30135,7 +32063,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30144,7 +32079,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30153,7 +32095,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30162,7 +32111,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30171,7 +32127,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30180,7 +32143,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30189,7 +32159,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30198,7 +32175,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30207,7 +32191,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30216,7 +32207,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30225,7 +32223,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30234,7 +32239,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30243,7 +32255,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30252,7 +32271,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30261,7 +32287,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30270,7 +32303,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30279,7 +32319,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30288,7 +32335,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30297,7 +32351,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30306,7 +32367,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30315,7 +32383,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30324,7 +32399,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30333,7 +32415,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30342,7 +32431,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30351,7 +32447,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30360,7 +32463,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30369,7 +32479,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30378,7 +32495,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30387,7 +32511,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30396,7 +32527,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30405,7 +32543,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30414,7 +32559,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30423,7 +32575,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30432,7 +32591,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30441,7 +32607,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30450,7 +32623,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30459,7 +32639,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30468,7 +32655,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30477,7 +32671,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30486,7 +32687,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30495,7 +32703,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30504,7 +32719,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30513,7 +32735,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30522,7 +32751,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30531,7 +32767,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30540,7 +32783,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30549,7 +32799,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30558,7 +32815,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30567,7 +32831,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30576,7 +32847,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30585,7 +32863,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30594,7 +32879,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30603,7 +32895,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30612,7 +32911,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30621,7 +32927,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30630,7 +32943,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30639,7 +32959,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30648,7 +32975,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30657,7 +32991,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30666,7 +33007,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30675,7 +33023,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30684,7 +33039,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30693,7 +33055,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30702,7 +33071,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30711,7 +33087,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30720,7 +33103,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30729,7 +33119,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30738,7 +33135,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30747,7 +33151,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30756,7 +33167,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30765,7 +33183,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30774,7 +33199,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30783,7 +33215,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30792,7 +33231,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30801,7 +33247,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30810,7 +33263,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30819,7 +33279,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30828,7 +33295,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30837,7 +33311,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30846,7 +33327,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30855,7 +33343,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30864,7 +33359,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30873,7 +33375,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30882,7 +33391,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30891,7 +33407,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30900,7 +33423,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30909,7 +33439,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30918,7 +33455,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30927,7 +33471,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30936,7 +33487,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30945,7 +33503,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30954,7 +33519,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30963,7 +33535,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30972,7 +33551,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30981,7 +33567,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30990,7 +33583,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -30999,7 +33599,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31008,7 +33615,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31017,7 +33631,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31026,7 +33647,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31035,7 +33663,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31044,7 +33679,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31053,7 +33695,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31062,7 +33711,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31071,7 +33727,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31080,7 +33743,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31089,7 +33759,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31098,7 +33775,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31107,7 +33791,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31116,7 +33807,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31125,7 +33823,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31134,7 +33839,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31143,7 +33855,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31152,7 +33871,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31161,7 +33887,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31170,7 +33903,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31179,7 +33919,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31188,7 +33935,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31197,7 +33951,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31206,7 +33967,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31215,7 +33983,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31224,7 +33999,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31233,7 +34015,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31242,7 +34031,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31251,7 +34047,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31260,7 +34063,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31269,7 +34079,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31278,7 +34095,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31287,7 +34111,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31296,7 +34127,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31305,7 +34143,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31314,7 +34159,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31323,7 +34175,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31332,7 +34191,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31341,7 +34207,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31350,7 +34223,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31359,7 +34239,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31368,7 +34255,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31377,7 +34271,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31386,7 +34287,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31395,7 +34303,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31404,7 +34319,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31413,7 +34335,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31422,7 +34351,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31431,7 +34367,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31440,7 +34383,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31449,7 +34399,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31458,7 +34415,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31467,7 +34431,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31476,7 +34447,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31485,7 +34463,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31494,7 +34479,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31503,7 +34495,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31512,7 +34511,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31521,7 +34527,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31530,7 +34543,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31539,7 +34559,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31548,7 +34575,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31557,7 +34591,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31566,7 +34607,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31575,7 +34623,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31584,7 +34639,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31593,7 +34655,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31602,7 +34671,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31611,7 +34687,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31620,7 +34703,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31629,7 +34719,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31638,7 +34735,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31647,7 +34751,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31656,7 +34767,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31665,7 +34783,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31674,7 +34799,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31683,7 +34815,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31692,7 +34831,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31701,7 +34847,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31710,7 +34863,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31719,7 +34879,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31728,7 +34895,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31737,7 +34911,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31746,7 +34927,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31755,7 +34943,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31764,7 +34959,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31773,7 +34975,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31782,7 +34991,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31791,7 +35007,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31800,7 +35023,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31809,7 +35039,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31818,7 +35055,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31827,7 +35071,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31836,7 +35087,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31845,7 +35103,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31854,7 +35119,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31863,7 +35135,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31872,7 +35151,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31881,7 +35167,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31890,7 +35183,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31899,7 +35199,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31908,7 +35215,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31917,7 +35231,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31926,7 +35247,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31935,7 +35263,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31944,7 +35279,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31953,7 +35295,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31962,7 +35311,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31971,7 +35327,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31980,7 +35343,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31989,7 +35359,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -31998,7 +35375,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32007,7 +35391,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32016,7 +35407,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32025,7 +35423,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32034,7 +35439,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32043,7 +35455,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32052,7 +35471,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32061,7 +35487,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32070,7 +35503,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32079,7 +35519,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32088,7 +35535,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32097,7 +35551,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32106,7 +35567,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32115,7 +35583,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32124,7 +35599,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32133,7 +35615,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32142,7 +35631,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32151,7 +35647,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32160,7 +35663,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32169,7 +35679,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32178,7 +35695,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32187,7 +35711,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32196,7 +35727,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32205,7 +35743,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32214,7 +35759,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32223,7 +35775,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32232,7 +35791,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32241,7 +35807,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32250,7 +35823,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32259,7 +35839,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32268,7 +35855,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32277,7 +35871,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32286,7 +35887,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32295,7 +35903,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32304,7 +35919,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32313,7 +35935,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32322,7 +35951,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32331,7 +35967,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32340,7 +35983,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32349,7 +35999,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32358,7 +36015,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32367,7 +36031,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32376,7 +36047,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32385,7 +36063,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32394,7 +36079,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32403,7 +36095,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32412,7 +36111,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32421,7 +36127,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32430,7 +36143,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32439,7 +36159,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32448,7 +36175,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32457,7 +36191,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32466,7 +36207,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32475,7 +36223,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32484,7 +36239,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32493,7 +36255,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32502,7 +36271,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32511,7 +36287,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32520,7 +36303,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32529,7 +36319,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32538,7 +36335,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32547,7 +36351,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32556,7 +36367,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32565,7 +36383,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32574,7 +36399,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32583,7 +36415,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32592,7 +36431,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32601,7 +36447,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32610,7 +36463,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32619,7 +36479,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32628,7 +36495,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32637,7 +36511,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32646,7 +36527,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32655,7 +36543,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32664,7 +36559,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32673,7 +36575,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32682,7 +36591,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32691,7 +36607,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32700,7 +36623,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32709,7 +36639,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32718,7 +36655,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32727,7 +36671,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32736,7 +36687,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32745,7 +36703,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32754,7 +36719,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32763,7 +36735,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32772,7 +36751,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32781,7 +36767,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32790,7 +36783,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32799,7 +36799,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32808,7 +36815,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32817,7 +36831,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32826,7 +36847,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32835,7 +36863,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32844,7 +36879,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32853,7 +36895,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32862,7 +36911,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32871,7 +36927,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32880,7 +36943,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32889,7 +36959,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32898,7 +36975,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32907,7 +36991,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32916,7 +37007,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32925,7 +37023,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32934,7 +37039,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32943,7 +37055,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32952,7 +37071,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32961,7 +37087,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32970,7 +37103,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32979,7 +37119,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32988,7 +37135,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -32997,7 +37151,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33006,7 +37167,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33015,7 +37183,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33024,7 +37199,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33033,7 +37215,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33042,7 +37231,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33051,7 +37247,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33060,7 +37263,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33069,7 +37279,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -33078,7 +37295,14 @@ T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 T1046,No,-,13 -T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,12 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 +T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,10 T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,10 @@ -44364,7 +48588,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44384,7 +48609,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44404,7 +48630,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44424,7 +48651,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44444,7 +48672,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44464,7 +48693,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44484,7 +48714,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44504,7 +48735,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44524,7 +48756,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44544,7 +48777,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44564,7 +48798,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44584,7 +48819,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44604,7 +48840,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44624,7 +48861,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44644,7 +48882,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44664,7 +48903,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44684,7 +48924,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44704,7 +48945,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44724,7 +48966,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44744,7 +48987,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44764,7 +49008,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44784,7 +49029,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44804,7 +49050,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44824,7 +49071,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44844,7 +49092,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44864,7 +49113,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44884,7 +49134,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44904,7 +49155,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44924,7 +49176,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44944,7 +49197,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44964,7 +49218,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -44984,7 +49239,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45004,7 +49260,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45024,7 +49281,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45044,7 +49302,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45064,7 +49323,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45084,7 +49344,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45104,7 +49365,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45124,7 +49386,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45144,7 +49407,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45164,7 +49428,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45184,7 +49449,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45204,7 +49470,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45224,7 +49491,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45244,7 +49512,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45264,7 +49533,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45284,7 +49554,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45304,7 +49575,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45324,7 +49596,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45344,7 +49617,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45364,7 +49638,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45384,7 +49659,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45404,7 +49680,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45424,7 +49701,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45444,7 +49722,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45464,7 +49743,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45484,7 +49764,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45504,7 +49785,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45524,7 +49806,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45544,7 +49827,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45564,7 +49848,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45584,7 +49869,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45604,7 +49890,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45624,7 +49911,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45644,7 +49932,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45664,7 +49953,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45684,7 +49974,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45704,7 +49995,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45724,7 +50016,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45744,7 +50037,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45764,7 +50058,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45784,7 +50079,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45804,7 +50100,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45824,7 +50121,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45844,7 +50142,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45864,7 +50163,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45884,7 +50184,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45904,7 +50205,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45924,7 +50226,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45944,7 +50247,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45964,7 +50268,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -45984,7 +50289,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46004,7 +50310,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46024,7 +50331,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46044,7 +50352,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46064,7 +50373,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46084,7 +50394,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46104,7 +50415,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46124,7 +50436,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46144,7 +50457,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46164,7 +50478,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46184,7 +50499,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46204,7 +50520,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46224,7 +50541,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46244,7 +50562,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46264,7 +50583,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46284,7 +50604,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46304,7 +50625,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46324,7 +50646,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46344,7 +50667,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46364,7 +50688,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46384,7 +50709,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46404,7 +50730,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46424,7 +50751,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46444,7 +50772,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46464,7 +50793,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46484,7 +50814,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46504,7 +50835,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46524,7 +50856,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46544,7 +50877,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46564,7 +50898,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46584,7 +50919,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46604,7 +50940,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46624,7 +50961,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46644,7 +50982,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46664,7 +51003,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46684,7 +51024,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46704,7 +51045,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46724,7 +51066,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46744,7 +51087,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46764,7 +51108,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46784,7 +51129,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46804,7 +51150,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46824,7 +51171,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46844,7 +51192,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46864,7 +51213,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46884,7 +51234,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46904,7 +51255,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46924,7 +51276,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46944,7 +51297,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46964,7 +51318,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -46984,7 +51339,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47004,7 +51360,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47024,7 +51381,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47044,7 +51402,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47064,7 +51423,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47084,7 +51444,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47104,7 +51465,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47124,7 +51486,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47144,7 +51507,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47164,7 +51528,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47184,7 +51549,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47204,7 +51570,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47224,7 +51591,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47244,7 +51612,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47264,7 +51633,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47284,7 +51654,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47304,7 +51675,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47324,7 +51696,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47344,7 +51717,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47364,7 +51738,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47384,7 +51759,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47404,7 +51780,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47424,7 +51801,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47444,7 +51822,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47464,7 +51843,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47484,7 +51864,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47504,7 +51885,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47524,7 +51906,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47544,7 +51927,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47564,7 +51948,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47584,7 +51969,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47604,7 +51990,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47624,7 +52011,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47644,7 +52032,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47664,7 +52053,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47684,7 +52074,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47704,7 +52095,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47724,7 +52116,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47744,7 +52137,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47764,7 +52158,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47784,7 +52179,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47804,7 +52200,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47824,7 +52221,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47844,7 +52242,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47864,7 +52263,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47884,7 +52284,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47904,7 +52305,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47924,7 +52326,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47944,7 +52347,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47964,7 +52368,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -47984,7 +52389,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48004,7 +52410,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48024,7 +52431,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48044,7 +52452,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48064,7 +52473,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48084,7 +52494,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48104,7 +52515,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48124,7 +52536,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48144,7 +52557,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48164,7 +52578,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48184,7 +52599,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48204,7 +52620,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48224,7 +52641,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48244,7 +52662,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48264,7 +52683,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48284,7 +52704,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48304,7 +52725,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48324,7 +52746,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48344,7 +52767,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48364,7 +52788,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48384,7 +52809,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48404,7 +52830,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48424,7 +52851,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48444,7 +52872,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48464,7 +52893,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48484,7 +52914,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48504,7 +52935,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48524,7 +52956,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48544,7 +52977,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48564,7 +52998,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48584,7 +53019,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48604,7 +53040,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48624,7 +53061,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48644,7 +53082,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48664,7 +53103,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48684,7 +53124,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48704,7 +53145,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48724,7 +53166,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48744,7 +53187,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48764,7 +53208,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48784,7 +53229,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48804,7 +53250,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48824,7 +53271,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48844,7 +53292,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48864,7 +53313,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48884,7 +53334,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48904,7 +53355,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48924,7 +53376,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48944,7 +53397,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48964,7 +53418,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -48984,7 +53439,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49004,7 +53460,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49024,7 +53481,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49044,7 +53502,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49064,7 +53523,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49084,7 +53544,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49104,7 +53565,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49124,7 +53586,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49144,7 +53607,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49164,7 +53628,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49184,7 +53649,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49204,7 +53670,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49224,7 +53691,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49244,7 +53712,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49264,7 +53733,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49284,7 +53754,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49304,7 +53775,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49324,7 +53796,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49344,7 +53817,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49364,7 +53838,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49384,7 +53859,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49404,7 +53880,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49424,7 +53901,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49444,7 +53922,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49464,7 +53943,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49484,7 +53964,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49504,7 +53985,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49524,7 +54006,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49544,7 +54027,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49564,7 +54048,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49584,7 +54069,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49604,7 +54090,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49624,7 +54111,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49644,7 +54132,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49664,7 +54153,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49684,7 +54174,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49704,7 +54195,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49724,7 +54216,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49744,7 +54237,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49764,7 +54258,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49784,7 +54279,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49804,7 +54300,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49824,7 +54321,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49844,7 +54342,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49864,7 +54363,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49884,7 +54384,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49904,7 +54405,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49924,7 +54426,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49944,7 +54447,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49964,7 +54468,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -49984,7 +54489,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50004,7 +54510,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50024,7 +54531,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50044,7 +54552,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50064,7 +54573,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50084,7 +54594,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50104,7 +54615,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50124,7 +54636,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50144,7 +54657,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50164,7 +54678,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50184,7 +54699,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50204,7 +54720,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50224,7 +54741,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50244,7 +54762,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50264,7 +54783,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50284,7 +54804,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50304,7 +54825,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50324,7 +54846,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50344,7 +54867,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50364,7 +54888,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50384,7 +54909,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50404,7 +54930,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50424,7 +54951,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50444,7 +54972,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50464,7 +54993,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50484,7 +55014,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50504,7 +55035,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50524,7 +55056,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50544,7 +55077,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50564,7 +55098,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50584,7 +55119,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50604,7 +55140,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50624,7 +55161,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50644,7 +55182,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50664,7 +55203,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50684,7 +55224,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50704,7 +55245,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50724,7 +55266,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50744,7 +55287,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50764,7 +55308,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50784,7 +55329,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50804,7 +55350,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50824,7 +55371,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50844,7 +55392,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50864,7 +55413,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50884,7 +55434,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50904,7 +55455,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50924,7 +55476,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50944,7 +55497,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50964,7 +55518,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -50984,7 +55539,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51004,7 +55560,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51024,7 +55581,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51044,7 +55602,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51064,7 +55623,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51084,7 +55644,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51104,7 +55665,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51124,7 +55686,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51144,7 +55707,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51164,7 +55728,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51184,7 +55749,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51204,7 +55770,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51224,7 +55791,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51244,7 +55812,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51264,7 +55833,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51284,7 +55854,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51304,7 +55875,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51324,7 +55896,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51344,7 +55917,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51364,7 +55938,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -51384,7 +55959,8 @@ T1219,No,-,8 T1117,No,-,8 T1090,No,-,8 T1102,No,-,8 -T1218.010,No,-,8 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,6 +T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,6 T1065,No,-,8 T1088,No,-,8 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,4 @@ -67239,7 +71815,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67260,7 +71839,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67281,7 +71863,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67302,7 +71887,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67323,7 +71911,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67344,7 +71935,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67365,7 +71959,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67386,7 +71983,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67407,7 +72007,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67428,7 +72031,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67449,7 +72055,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67470,7 +72079,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67491,7 +72103,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67512,7 +72127,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67533,7 +72151,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67554,7 +72175,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67575,7 +72199,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67596,7 +72223,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67617,7 +72247,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67638,7 +72271,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67659,7 +72295,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67680,7 +72319,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67701,7 +72343,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67722,7 +72367,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67743,7 +72391,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67764,7 +72415,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67785,7 +72439,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67806,7 +72463,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67827,7 +72487,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67848,7 +72511,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67869,7 +72535,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67890,7 +72559,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67911,7 +72583,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67932,7 +72607,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67953,7 +72631,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67974,7 +72655,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -67995,7 +72679,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68016,7 +72703,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68037,7 +72727,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68058,7 +72751,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68079,7 +72775,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68100,7 +72799,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68121,7 +72823,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68142,7 +72847,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68163,7 +72871,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68184,7 +72895,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68205,7 +72919,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68226,7 +72943,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68247,7 +72967,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68268,7 +72991,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68289,7 +73015,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68310,7 +73039,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68331,7 +73063,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68352,7 +73087,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68373,7 +73111,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68394,7 +73135,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68415,7 +73159,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68436,7 +73183,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68457,7 +73207,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68478,7 +73231,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68499,7 +73255,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68520,7 +73279,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68541,7 +73303,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68562,7 +73327,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68583,7 +73351,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68604,7 +73375,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68625,7 +73399,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68646,7 +73423,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68667,7 +73447,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68688,7 +73471,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68709,7 +73495,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68730,7 +73519,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68751,7 +73543,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68772,7 +73567,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68793,7 +73591,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68814,7 +73615,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68835,7 +73639,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68856,7 +73663,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68877,7 +73687,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68898,7 +73711,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68919,7 +73735,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68940,7 +73759,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68961,7 +73783,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -68982,7 +73807,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69003,7 +73831,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69024,7 +73855,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69045,7 +73879,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69066,7 +73903,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69087,7 +73927,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69108,7 +73951,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69129,7 +73975,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69150,7 +73999,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69171,7 +74023,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69192,7 +74047,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69213,7 +74071,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69234,7 +74095,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69255,7 +74119,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69276,7 +74143,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69297,7 +74167,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69318,7 +74191,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69339,7 +74215,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69360,7 +74239,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69381,7 +74263,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69402,7 +74287,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69423,7 +74311,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69444,7 +74335,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69465,7 +74359,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69486,7 +74383,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69507,7 +74407,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69528,7 +74431,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69549,7 +74455,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69570,7 +74479,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69591,7 +74503,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69612,7 +74527,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69633,7 +74551,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69654,7 +74575,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69675,7 +74599,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69696,7 +74623,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69717,7 +74647,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69738,7 +74671,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69759,7 +74695,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69780,7 +74719,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69801,7 +74743,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69822,7 +74767,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69843,7 +74791,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69864,7 +74815,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69885,7 +74839,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69906,7 +74863,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69927,7 +74887,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69948,7 +74911,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69969,7 +74935,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -69990,7 +74959,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70011,7 +74983,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70032,7 +75007,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70053,7 +75031,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70074,7 +75055,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70095,7 +75079,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70116,7 +75103,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70137,7 +75127,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70158,7 +75151,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70179,7 +75175,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70200,7 +75199,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70221,7 +75223,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70242,7 +75247,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70263,7 +75271,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70284,7 +75295,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70305,7 +75319,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70326,7 +75343,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70347,7 +75367,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70368,7 +75391,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70389,7 +75415,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70410,7 +75439,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70431,7 +75463,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70452,7 +75487,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70473,7 +75511,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70494,7 +75535,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70515,7 +75559,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70536,7 +75583,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70557,7 +75607,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70578,7 +75631,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70599,7 +75655,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70620,7 +75679,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70641,7 +75703,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70662,7 +75727,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70683,7 +75751,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70704,7 +75775,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70725,7 +75799,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70746,7 +75823,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70767,7 +75847,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70788,7 +75871,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70809,7 +75895,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70830,7 +75919,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70851,7 +75943,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70872,7 +75967,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70893,7 +75991,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70914,7 +76015,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70935,7 +76039,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70956,7 +76063,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70977,7 +76087,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -70998,7 +76111,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71019,7 +76135,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71040,7 +76159,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71061,7 +76183,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71082,7 +76207,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71103,7 +76231,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71124,7 +76255,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71145,7 +76279,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71166,7 +76303,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71187,7 +76327,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71208,7 +76351,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71229,7 +76375,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71250,7 +76399,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71271,7 +76423,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71292,7 +76447,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71313,7 +76471,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71334,7 +76495,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71355,7 +76519,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71376,7 +76543,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71397,7 +76567,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71418,7 +76591,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71439,7 +76615,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71460,7 +76639,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71481,7 +76663,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71502,7 +76687,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71523,7 +76711,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71544,7 +76735,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71565,7 +76759,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71586,7 +76783,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71607,7 +76807,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71628,7 +76831,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71649,7 +76855,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71670,7 +76879,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71691,7 +76903,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71712,7 +76927,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71733,7 +76951,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71754,7 +76975,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71775,7 +76999,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71796,7 +77023,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71817,7 +77047,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71838,7 +77071,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71859,7 +77095,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71880,7 +77119,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71901,7 +77143,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71922,7 +77167,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71943,7 +77191,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71964,7 +77215,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -71985,7 +77239,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72006,7 +77263,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72027,7 +77287,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72048,7 +77311,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72069,7 +77335,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72090,7 +77359,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72111,7 +77383,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72132,7 +77407,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72153,7 +77431,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72174,7 +77455,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72195,7 +77479,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72216,7 +77503,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72237,7 +77527,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72258,7 +77551,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72279,7 +77575,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72300,7 +77599,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72321,7 +77623,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72342,7 +77647,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72363,7 +77671,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72384,7 +77695,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72405,7 +77719,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72426,7 +77743,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72447,7 +77767,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72468,7 +77791,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72489,7 +77815,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72510,7 +77839,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72531,7 +77863,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72552,7 +77887,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72573,7 +77911,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72594,7 +77935,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72615,7 +77959,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72636,7 +77983,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72657,7 +78007,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72678,7 +78031,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72699,7 +78055,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72720,7 +78079,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72741,7 +78103,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72762,7 +78127,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72783,7 +78151,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72804,7 +78175,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72825,7 +78199,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72846,7 +78223,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72867,7 +78247,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72888,7 +78271,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72909,7 +78295,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72930,7 +78319,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72951,7 +78343,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72972,7 +78367,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -72993,7 +78391,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73014,7 +78415,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73035,7 +78439,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73056,7 +78463,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73077,7 +78487,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73098,7 +78511,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73119,7 +78535,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73140,7 +78559,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73161,7 +78583,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73182,7 +78607,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73203,7 +78631,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73224,7 +78655,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73245,7 +78679,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73266,7 +78703,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73287,7 +78727,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73308,7 +78751,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73329,7 +78775,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73350,7 +78799,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73371,7 +78823,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73392,7 +78847,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73413,7 +78871,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73434,7 +78895,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73455,7 +78919,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73476,7 +78943,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73497,7 +78967,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73518,7 +78991,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73539,7 +79015,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73560,7 +79039,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73581,7 +79063,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73602,7 +79087,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73623,7 +79111,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73644,7 +79135,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73665,7 +79159,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73686,7 +79183,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73707,7 +79207,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73728,7 +79231,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73749,7 +79255,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73770,7 +79279,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73791,7 +79303,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73812,7 +79327,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73833,7 +79351,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73854,7 +79375,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73875,7 +79399,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73896,7 +79423,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73917,7 +79447,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73938,7 +79471,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73959,7 +79495,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -73980,7 +79519,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74001,7 +79543,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74022,7 +79567,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74043,7 +79591,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74064,7 +79615,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74085,7 +79639,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74106,7 +79663,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74127,7 +79687,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74148,7 +79711,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74169,7 +79735,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74190,7 +79759,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74211,7 +79783,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74232,7 +79807,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74253,7 +79831,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74274,7 +79855,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74295,7 +79879,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74316,7 +79903,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74337,7 +79927,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74358,7 +79951,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74379,7 +79975,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74400,7 +79999,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74421,7 +80023,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74442,7 +80047,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74463,7 +80071,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74484,7 +80095,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74505,7 +80119,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74526,7 +80143,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74547,7 +80167,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74568,7 +80191,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74589,7 +80215,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74610,7 +80239,10 @@ T1087,No,-,5 T1020,No,-,5 T1015,No,-,5 T1566,No,-,5 -T1218.001,No,-,5 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 +T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1 T1195.002,No,-,5 T1573.002,No,-,5 T1075,No,-,5 @@ -74641,21 +80273,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74676,21 +80310,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74711,21 +80347,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74746,21 +80384,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74781,21 +80421,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74816,21 +80458,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74851,21 +80495,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74886,21 +80532,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74921,21 +80569,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74956,21 +80606,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -74991,21 +80643,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75026,21 +80680,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75061,21 +80717,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75096,21 +80754,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75131,21 +80791,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75166,21 +80828,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75201,21 +80865,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75236,21 +80902,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75271,21 +80939,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75306,21 +80976,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75341,21 +81013,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75376,21 +81050,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75411,21 +81087,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75446,21 +81124,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75481,21 +81161,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75516,21 +81198,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75551,21 +81235,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75586,21 +81272,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75621,21 +81309,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75656,21 +81346,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75691,21 +81383,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75726,21 +81420,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75761,21 +81457,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75796,21 +81494,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75831,21 +81531,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75866,21 +81568,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75901,21 +81605,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75936,21 +81642,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -75971,21 +81679,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76006,21 +81716,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76041,21 +81753,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76076,21 +81790,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76111,21 +81827,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76146,21 +81864,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76181,21 +81901,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76216,21 +81938,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76251,21 +81975,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76286,21 +82012,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76321,21 +82049,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76356,21 +82086,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76391,21 +82123,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76426,21 +82160,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76461,21 +82197,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76496,21 +82234,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76531,21 +82271,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76566,21 +82308,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76601,21 +82345,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76636,21 +82382,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76671,21 +82419,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76706,21 +82456,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76741,21 +82493,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76776,21 +82530,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76811,21 +82567,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76846,21 +82604,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76881,21 +82641,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76916,21 +82678,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76951,21 +82715,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -76986,21 +82752,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77021,21 +82789,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77056,21 +82826,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77091,21 +82863,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77126,21 +82900,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77161,21 +82937,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77196,21 +82974,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77231,21 +83011,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77266,21 +83048,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77301,21 +83085,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77336,21 +83122,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77371,21 +83159,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77406,21 +83196,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77441,21 +83233,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77476,21 +83270,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77511,21 +83307,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77546,21 +83344,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77581,21 +83381,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77616,21 +83418,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77651,21 +83455,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77686,21 +83492,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77721,21 +83529,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77756,21 +83566,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77791,21 +83603,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77826,21 +83640,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77861,21 +83677,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77896,21 +83714,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77931,21 +83751,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -77966,21 +83788,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78001,21 +83825,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78036,21 +83862,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78071,21 +83899,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78106,21 +83936,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78141,21 +83973,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78176,21 +84010,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78211,21 +84047,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78246,21 +84084,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78281,21 +84121,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78316,21 +84158,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78351,21 +84195,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78386,21 +84232,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78421,21 +84269,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78456,21 +84306,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78491,21 +84343,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78526,21 +84380,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78561,21 +84417,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78596,21 +84454,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78631,21 +84491,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78666,21 +84528,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78701,21 +84565,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78736,21 +84602,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78771,21 +84639,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78806,21 +84676,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78841,21 +84713,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78876,21 +84750,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78911,21 +84787,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78946,21 +84824,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -78981,21 +84861,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79016,21 +84898,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79051,21 +84935,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79086,21 +84972,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79121,21 +85009,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79156,21 +85046,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79191,21 +85083,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79226,21 +85120,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79261,21 +85157,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79296,21 +85194,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79331,21 +85231,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79366,21 +85268,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79401,21 +85305,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79436,21 +85342,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79471,21 +85379,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79506,21 +85416,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79541,21 +85453,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79576,21 +85490,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79611,21 +85527,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79646,21 +85564,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79681,21 +85601,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79716,21 +85638,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79751,21 +85675,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79786,21 +85712,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79821,21 +85749,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79856,21 +85786,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79891,21 +85823,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79926,21 +85860,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79961,21 +85897,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -79996,21 +85934,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80031,21 +85971,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80066,21 +86008,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80101,21 +86045,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80136,21 +86082,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80171,21 +86119,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80206,21 +86156,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80241,21 +86193,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80276,21 +86230,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80311,21 +86267,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80346,21 +86304,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80381,21 +86341,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80416,21 +86378,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80451,21 +86415,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80486,21 +86452,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80521,21 +86489,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80556,21 +86526,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80591,21 +86563,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80626,21 +86600,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80661,21 +86637,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80696,21 +86674,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80731,21 +86711,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80766,21 +86748,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80801,21 +86785,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80836,21 +86822,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80871,21 +86859,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80906,21 +86896,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80941,21 +86933,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -80976,21 +86970,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81011,21 +87007,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81046,21 +87044,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81081,21 +87081,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81116,21 +87118,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81151,21 +87155,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81186,21 +87192,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81221,21 +87229,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81256,21 +87266,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81291,21 +87303,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81326,21 +87340,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81361,21 +87377,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81396,21 +87414,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81431,21 +87451,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81466,21 +87488,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81501,21 +87525,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81536,21 +87562,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81571,21 +87599,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81606,21 +87636,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81641,21 +87673,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81676,21 +87710,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81711,21 +87747,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81746,21 +87784,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81781,21 +87821,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81816,21 +87858,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81851,21 +87895,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81886,21 +87932,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81921,21 +87969,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81956,21 +88006,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -81991,21 +88043,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82026,21 +88080,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82061,21 +88117,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82096,21 +88154,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82131,21 +88191,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82166,21 +88228,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82201,21 +88265,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82236,21 +88302,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82271,21 +88339,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82306,21 +88376,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82341,21 +88413,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82376,21 +88450,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82411,21 +88487,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82446,21 +88524,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82481,21 +88561,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82516,21 +88598,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82551,21 +88635,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82586,21 +88672,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82621,21 +88709,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82656,21 +88746,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82691,21 +88783,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82726,21 +88820,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82761,21 +88857,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82796,21 +88894,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82831,21 +88931,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82866,21 +88968,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82901,21 +89005,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82936,21 +89042,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -82971,21 +89079,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83006,21 +89116,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83041,21 +89153,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83076,21 +89190,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83111,21 +89227,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83146,21 +89264,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83181,21 +89301,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83216,21 +89338,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83251,21 +89375,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83286,21 +89412,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83321,21 +89449,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83356,21 +89486,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83391,21 +89523,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83426,21 +89560,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83461,21 +89597,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83496,21 +89634,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83531,21 +89671,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83566,21 +89708,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83601,21 +89745,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83636,21 +89782,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83671,21 +89819,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83706,21 +89856,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83741,21 +89893,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83776,21 +89930,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83811,21 +89967,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83846,21 +90004,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83881,21 +90041,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83916,21 +90078,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83951,21 +90115,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -83986,21 +90152,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84021,21 +90189,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84056,21 +90226,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84091,21 +90263,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84126,21 +90300,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84161,21 +90337,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84196,21 +90374,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84231,21 +90411,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84266,21 +90448,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84301,21 +90485,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84336,21 +90522,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84371,21 +90559,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84406,21 +90596,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84441,21 +90633,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84476,21 +90670,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84511,21 +90707,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84546,21 +90744,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84581,21 +90781,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84616,21 +90818,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84651,21 +90855,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84686,21 +90892,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84721,21 +90929,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84756,21 +90966,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84791,21 +91003,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84826,21 +91040,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84861,21 +91077,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84896,21 +91114,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84931,21 +91151,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -84966,21 +91188,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85001,21 +91225,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85036,21 +91262,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85071,21 +91299,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85106,21 +91336,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85141,21 +91373,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85176,21 +91410,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85211,21 +91447,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85246,21 +91484,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85281,21 +91521,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85316,21 +91558,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85351,21 +91595,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85386,21 +91632,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85421,21 +91669,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85456,21 +91706,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85491,21 +91743,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85526,21 +91780,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85561,21 +91817,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85596,21 +91854,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85631,21 +91891,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85666,21 +91928,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85701,21 +91965,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85736,21 +92002,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85771,21 +92039,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85806,21 +92076,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85841,21 +92113,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85876,21 +92150,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85911,21 +92187,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85946,21 +92224,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -85981,21 +92261,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86016,21 +92298,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86051,21 +92335,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86086,21 +92372,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86121,21 +92409,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86156,21 +92446,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86191,21 +92483,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86226,21 +92520,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86261,21 +92557,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86296,21 +92594,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86331,21 +92631,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86366,21 +92668,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86401,21 +92705,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86436,21 +92742,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86471,21 +92779,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86506,21 +92816,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86541,21 +92853,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86576,21 +92890,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86611,21 +92927,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86646,21 +92964,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86681,21 +93001,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86716,21 +93038,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86751,21 +93075,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86786,21 +93112,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86821,21 +93149,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86856,21 +93186,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86891,21 +93223,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1561.002,No,-,4 @@ -86926,21 +93260,23 @@ T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1001,No,-,4 T1039,No,-,4 T1055.012,No,-,4 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-1 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-1 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 T1496,No,-,4 T1213,No,-,4 T1518,No,-,4 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-1 -T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-1 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,-2 +T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,-2 T1124,No,-,4 T1094,No,-,4 T1067,No,-,3 diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json index bd51435de2..cd96def0b1 100644 --- a/docs/mitre-map/detections.json +++ b/docs/mitre-map/detections.json @@ -26764,9 +26764,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26776,9 +26776,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26788,9 +26788,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26800,9 +26800,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26812,9 +26812,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26824,9 +26824,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26836,9 +26836,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26848,9 +26848,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26860,9 +26860,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26872,9 +26872,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26884,9 +26884,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26896,9 +26896,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26908,9 +26908,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26920,9 +26920,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26932,9 +26932,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26944,9 +26944,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26956,9 +26956,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26968,9 +26968,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26980,9 +26980,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -26992,9 +26992,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27004,9 +27004,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27016,9 +27016,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27028,9 +27028,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27040,9 +27040,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27052,9 +27052,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27064,9 +27064,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27076,9 +27076,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27088,9 +27088,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27100,9 +27100,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27112,9 +27112,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27124,9 +27124,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27136,9 +27136,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27148,9 +27148,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27160,9 +27160,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27172,9 +27172,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27184,9 +27184,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27196,9 +27196,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27208,9 +27208,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27220,9 +27220,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27232,9 +27232,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27244,9 +27244,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27256,9 +27256,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27268,9 +27268,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27280,9 +27280,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27292,9 +27292,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27304,9 +27304,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27316,9 +27316,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27328,9 +27328,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27340,9 +27340,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27352,9 +27352,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27364,9 +27364,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27376,9 +27376,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27388,9 +27388,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27400,9 +27400,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27412,9 +27412,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27424,9 +27424,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27436,9 +27436,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27448,9 +27448,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27460,9 +27460,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27472,9 +27472,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27484,9 +27484,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27496,9 +27496,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27508,9 +27508,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27520,9 +27520,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27532,9 +27532,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27544,9 +27544,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27556,9 +27556,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27568,9 +27568,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27580,9 +27580,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27592,9 +27592,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27604,9 +27604,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27616,9 +27616,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27628,9 +27628,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27640,9 +27640,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27652,9 +27652,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27664,9 +27664,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27676,9 +27676,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27688,9 +27688,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27700,9 +27700,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27712,9 +27712,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27724,9 +27724,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27736,9 +27736,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27748,9 +27748,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27760,9 +27760,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27772,9 +27772,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27784,9 +27784,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27796,9 +27796,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27808,9 +27808,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27820,9 +27820,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27832,9 +27832,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27844,9 +27844,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27856,9 +27856,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27868,9 +27868,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27880,9 +27880,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27892,9 +27892,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27904,9 +27904,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27916,9 +27916,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27928,9 +27928,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27940,9 +27940,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27952,9 +27952,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27964,9 +27964,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27976,9 +27976,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -27988,9 +27988,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28000,9 +28000,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28012,9 +28012,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28024,9 +28024,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28036,9 +28036,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28048,9 +28048,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28060,9 +28060,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28072,9 +28072,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28084,9 +28084,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28096,9 +28096,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28108,9 +28108,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28120,9 +28120,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28132,9 +28132,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28144,9 +28144,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28156,9 +28156,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28168,9 +28168,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28180,9 +28180,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28192,9 +28192,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28204,9 +28204,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28216,9 +28216,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28228,9 +28228,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28240,9 +28240,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28252,9 +28252,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28264,9 +28264,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28276,9 +28276,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28288,9 +28288,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28300,9 +28300,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28312,9 +28312,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28324,9 +28324,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28336,9 +28336,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28348,9 +28348,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28360,9 +28360,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28372,9 +28372,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28384,9 +28384,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28396,9 +28396,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28408,9 +28408,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28420,9 +28420,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28432,9 +28432,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28444,9 +28444,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28456,9 +28456,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28468,9 +28468,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28480,9 +28480,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28492,9 +28492,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28504,9 +28504,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28516,9 +28516,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28528,9 +28528,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28540,9 +28540,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28552,9 +28552,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28564,9 +28564,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28576,9 +28576,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28588,9 +28588,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28600,9 +28600,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28612,9 +28612,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28624,9 +28624,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28636,9 +28636,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28648,9 +28648,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28660,9 +28660,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28672,9 +28672,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28684,9 +28684,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28696,9 +28696,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28708,9 +28708,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28720,9 +28720,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28732,9 +28732,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28744,9 +28744,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28756,9 +28756,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28768,9 +28768,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28780,9 +28780,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28792,9 +28792,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28804,9 +28804,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28816,9 +28816,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28828,9 +28828,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28840,9 +28840,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28852,9 +28852,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28864,9 +28864,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28876,9 +28876,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28888,9 +28888,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28900,9 +28900,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28912,9 +28912,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28924,9 +28924,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28936,9 +28936,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28948,9 +28948,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28960,9 +28960,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28972,9 +28972,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28984,9 +28984,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -28996,9 +28996,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29008,9 +29008,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29020,9 +29020,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29032,9 +29032,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29044,9 +29044,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29056,9 +29056,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29068,9 +29068,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29080,9 +29080,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29092,9 +29092,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29104,9 +29104,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29116,9 +29116,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29128,9 +29128,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29140,9 +29140,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29152,9 +29152,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29164,9 +29164,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29176,9 +29176,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29188,9 +29188,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29200,9 +29200,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29212,9 +29212,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29224,9 +29224,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29236,9 +29236,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29248,9 +29248,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29260,9 +29260,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29272,9 +29272,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29284,9 +29284,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29296,9 +29296,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29308,9 +29308,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29320,9 +29320,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29332,9 +29332,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29344,9 +29344,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29356,9 +29356,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29368,9 +29368,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29380,9 +29380,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29392,9 +29392,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29404,9 +29404,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29416,9 +29416,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29428,9 +29428,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29440,9 +29440,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29452,9 +29452,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29464,9 +29464,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29476,9 +29476,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29488,9 +29488,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29500,9 +29500,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29512,9 +29512,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29524,9 +29524,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29536,9 +29536,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29548,9 +29548,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29560,9 +29560,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29572,9 +29572,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29584,9 +29584,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29596,9 +29596,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29608,9 +29608,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29620,9 +29620,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29632,9 +29632,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29644,9 +29644,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29656,9 +29656,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29668,9 +29668,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29680,9 +29680,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29692,9 +29692,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29704,9 +29704,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29716,9 +29716,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29728,9 +29728,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29740,9 +29740,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29752,9 +29752,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29764,9 +29764,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29776,9 +29776,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29788,9 +29788,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29800,9 +29800,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29812,9 +29812,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29824,9 +29824,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29836,9 +29836,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29848,9 +29848,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29860,9 +29860,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29872,9 +29872,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29884,9 +29884,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29896,9 +29896,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29908,9 +29908,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29920,9 +29920,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29932,9 +29932,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29944,9 +29944,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29956,9 +29956,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29968,9 +29968,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29980,9 +29980,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -29992,9 +29992,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30004,9 +30004,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30016,9 +30016,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30028,9 +30028,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30040,9 +30040,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30052,9 +30052,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30064,9 +30064,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30076,9 +30076,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30088,9 +30088,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30100,9 +30100,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30112,9 +30112,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30124,9 +30124,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30136,9 +30136,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30148,9 +30148,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30160,9 +30160,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30172,9 +30172,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30184,9 +30184,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30196,9 +30196,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30208,9 +30208,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30220,9 +30220,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30232,9 +30232,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30244,9 +30244,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30256,9 +30256,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30268,9 +30268,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30280,9 +30280,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30292,9 +30292,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30304,9 +30304,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30316,9 +30316,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30328,9 +30328,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30340,9 +30340,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30352,9 +30352,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30364,9 +30364,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30376,9 +30376,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30388,9 +30388,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30400,9 +30400,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30412,9 +30412,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30424,9 +30424,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30436,9 +30436,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30448,9 +30448,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30460,9 +30460,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30472,9 +30472,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30484,9 +30484,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30496,9 +30496,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30508,9 +30508,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30520,9 +30520,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30532,9 +30532,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30544,9 +30544,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30556,9 +30556,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30568,9 +30568,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30580,9 +30580,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30592,9 +30592,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30604,9 +30604,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30616,9 +30616,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30628,9 +30628,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30640,9 +30640,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30652,9 +30652,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30664,9 +30664,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30676,9 +30676,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30688,9 +30688,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30700,9 +30700,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30712,9 +30712,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30724,9 +30724,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30736,9 +30736,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30748,9 +30748,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30760,9 +30760,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30772,9 +30772,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30784,9 +30784,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30796,9 +30796,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30808,9 +30808,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30820,9 +30820,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30832,9 +30832,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30844,9 +30844,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30856,9 +30856,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30868,9 +30868,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30880,9 +30880,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30892,9 +30892,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30904,9 +30904,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30916,9 +30916,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30928,9 +30928,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30940,9 +30940,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30952,9 +30952,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30964,9 +30964,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1053.005", @@ -30976,9 +30976,9 @@ }, { "techniqueID": "T1078", - "score": 24, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" }, { "techniqueID": "T1082", @@ -30988,9 +30988,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31005,9 +31005,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31022,9 +31022,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31039,9 +31039,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31056,9 +31056,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31073,9 +31073,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31090,9 +31090,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31107,9 +31107,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31124,9 +31124,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31141,9 +31141,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31158,9 +31158,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31175,9 +31175,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31192,9 +31192,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31209,9 +31209,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31226,9 +31226,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31243,9 +31243,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31260,9 +31260,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31277,9 +31277,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31294,9 +31294,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31311,9 +31311,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31328,9 +31328,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31345,9 +31345,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31362,9 +31362,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31379,9 +31379,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31396,9 +31396,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31413,9 +31413,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31430,9 +31430,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31447,9 +31447,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31464,9 +31464,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31481,9 +31481,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31498,9 +31498,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31515,9 +31515,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31532,9 +31532,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31549,9 +31549,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31566,9 +31566,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31583,9 +31583,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31600,9 +31600,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31617,9 +31617,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31634,9 +31634,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31651,9 +31651,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31668,9 +31668,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31685,9 +31685,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31702,9 +31702,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31719,9 +31719,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31736,9 +31736,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31753,9 +31753,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31770,9 +31770,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31787,9 +31787,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31804,9 +31804,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31821,9 +31821,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31838,9 +31838,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31855,9 +31855,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31872,9 +31872,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31889,9 +31889,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31906,9 +31906,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31923,9 +31923,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31940,9 +31940,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31957,9 +31957,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31974,9 +31974,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31991,9 +31991,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32008,9 +32008,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32025,9 +32025,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32042,9 +32042,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32059,9 +32059,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32076,9 +32076,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32093,9 +32093,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32110,9 +32110,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32127,9 +32127,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32144,9 +32144,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32161,9 +32161,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32178,9 +32178,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32195,9 +32195,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32212,9 +32212,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32229,9 +32229,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32246,9 +32246,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32263,9 +32263,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32280,9 +32280,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32297,9 +32297,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32314,9 +32314,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32331,9 +32331,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32348,9 +32348,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32365,9 +32365,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32382,9 +32382,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32399,9 +32399,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32416,9 +32416,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32433,9 +32433,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32450,9 +32450,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32467,9 +32467,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32484,9 +32484,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32501,9 +32501,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32518,9 +32518,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32535,9 +32535,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32552,9 +32552,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32569,9 +32569,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32586,9 +32586,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32603,9 +32603,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32620,9 +32620,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32637,9 +32637,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32654,9 +32654,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32671,9 +32671,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32688,9 +32688,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32705,9 +32705,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32722,9 +32722,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32739,9 +32739,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32756,9 +32756,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32773,9 +32773,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32790,9 +32790,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32807,9 +32807,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32824,9 +32824,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32841,9 +32841,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32858,9 +32858,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32875,9 +32875,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32892,9 +32892,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32909,9 +32909,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32926,9 +32926,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32943,9 +32943,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32960,9 +32960,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32977,9 +32977,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32994,9 +32994,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33011,9 +33011,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33028,9 +33028,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33045,9 +33045,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33062,9 +33062,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33079,9 +33079,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33096,9 +33096,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33113,9 +33113,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33130,9 +33130,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33147,9 +33147,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33164,9 +33164,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33181,9 +33181,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33198,9 +33198,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33215,9 +33215,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33232,9 +33232,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33249,9 +33249,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33266,9 +33266,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33283,9 +33283,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33300,9 +33300,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33317,9 +33317,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33334,9 +33334,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33351,9 +33351,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33368,9 +33368,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33385,9 +33385,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33402,9 +33402,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33419,9 +33419,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33436,9 +33436,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33453,9 +33453,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33470,9 +33470,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33487,9 +33487,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33504,9 +33504,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33521,9 +33521,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33538,9 +33538,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33555,9 +33555,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33572,9 +33572,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33589,9 +33589,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33606,9 +33606,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33623,9 +33623,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33640,9 +33640,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33657,9 +33657,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33674,9 +33674,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33691,9 +33691,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33708,9 +33708,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33725,9 +33725,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33742,9 +33742,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33759,9 +33759,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33776,9 +33776,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33793,9 +33793,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33810,9 +33810,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33827,9 +33827,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33844,9 +33844,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33861,9 +33861,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33878,9 +33878,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33895,9 +33895,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33912,9 +33912,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33929,9 +33929,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33946,9 +33946,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33963,9 +33963,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33980,9 +33980,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33997,9 +33997,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34014,9 +34014,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34031,9 +34031,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34048,9 +34048,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34065,9 +34065,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34082,9 +34082,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34099,9 +34099,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34116,9 +34116,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34133,9 +34133,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34150,9 +34150,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34167,9 +34167,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34184,9 +34184,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34201,9 +34201,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34218,9 +34218,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34235,9 +34235,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34252,9 +34252,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34269,9 +34269,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34286,9 +34286,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34303,9 +34303,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34320,9 +34320,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34337,9 +34337,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34354,9 +34354,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34371,9 +34371,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34388,9 +34388,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34405,9 +34405,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34422,9 +34422,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34439,9 +34439,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34456,9 +34456,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34473,9 +34473,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34490,9 +34490,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34507,9 +34507,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34524,9 +34524,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34541,9 +34541,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34558,9 +34558,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34575,9 +34575,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34592,9 +34592,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34609,9 +34609,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34626,9 +34626,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34643,9 +34643,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34660,9 +34660,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34677,9 +34677,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34694,9 +34694,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34711,9 +34711,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34728,9 +34728,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34745,9 +34745,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34762,9 +34762,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34779,9 +34779,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34796,9 +34796,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34813,9 +34813,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34830,9 +34830,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34847,9 +34847,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34864,9 +34864,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34881,9 +34881,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34898,9 +34898,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34915,9 +34915,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34932,9 +34932,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34949,9 +34949,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34966,9 +34966,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34983,9 +34983,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35000,9 +35000,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35017,9 +35017,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35034,9 +35034,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35051,9 +35051,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35068,9 +35068,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35085,9 +35085,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35102,9 +35102,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35119,9 +35119,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35136,9 +35136,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35153,9 +35153,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35170,9 +35170,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35187,9 +35187,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35204,9 +35204,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35221,9 +35221,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35238,9 +35238,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35255,9 +35255,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35272,9 +35272,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35289,9 +35289,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35306,9 +35306,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35323,9 +35323,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35340,9 +35340,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35357,9 +35357,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35374,9 +35374,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35391,9 +35391,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35408,9 +35408,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35425,9 +35425,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35442,9 +35442,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35459,9 +35459,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35476,9 +35476,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35493,9 +35493,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35510,9 +35510,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35527,9 +35527,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35544,9 +35544,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35561,9 +35561,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35578,9 +35578,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35595,9 +35595,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35612,9 +35612,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35629,9 +35629,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35646,9 +35646,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35663,9 +35663,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35680,9 +35680,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35697,9 +35697,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35714,9 +35714,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35731,9 +35731,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35748,9 +35748,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35765,9 +35765,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35782,9 +35782,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35799,9 +35799,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35816,9 +35816,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35833,9 +35833,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35850,9 +35850,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35867,9 +35867,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35884,9 +35884,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35901,9 +35901,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35918,9 +35918,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35935,9 +35935,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35952,9 +35952,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35969,9 +35969,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35986,9 +35986,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36003,9 +36003,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36020,9 +36020,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36037,9 +36037,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36054,9 +36054,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36071,9 +36071,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36088,9 +36088,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36105,9 +36105,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36122,9 +36122,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36139,9 +36139,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36156,9 +36156,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36173,9 +36173,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36190,9 +36190,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36207,9 +36207,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36224,9 +36224,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36241,9 +36241,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36258,9 +36258,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36275,9 +36275,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36292,9 +36292,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36309,9 +36309,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36326,9 +36326,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36343,9 +36343,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36360,9 +36360,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36377,9 +36377,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36394,9 +36394,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36411,9 +36411,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36428,9 +36428,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36445,9 +36445,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36462,9 +36462,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36479,9 +36479,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36496,9 +36496,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36513,9 +36513,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36530,9 +36530,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36547,9 +36547,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36564,9 +36564,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36581,9 +36581,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36598,9 +36598,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36615,9 +36615,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36632,9 +36632,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36649,9 +36649,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36666,9 +36666,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36683,9 +36683,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36700,9 +36700,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36717,9 +36717,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36734,9 +36734,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36751,9 +36751,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36768,9 +36768,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36785,9 +36785,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36802,9 +36802,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36819,9 +36819,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36836,9 +36836,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36853,9 +36853,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36870,9 +36870,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36887,9 +36887,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36904,9 +36904,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36921,9 +36921,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36938,9 +36938,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36955,9 +36955,9 @@ }, { "techniqueID": "T1003.001", - "score": 20, + "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -98918,9 +98918,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -98955,9 +98955,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -98992,9 +98992,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99029,9 +99029,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99066,9 +99066,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99103,9 +99103,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99140,9 +99140,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99177,9 +99177,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99214,9 +99214,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99251,9 +99251,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99288,9 +99288,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99325,9 +99325,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99362,9 +99362,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99399,9 +99399,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99436,9 +99436,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99473,9 +99473,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99510,9 +99510,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99547,9 +99547,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99584,9 +99584,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99621,9 +99621,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99658,9 +99658,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99695,9 +99695,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99732,9 +99732,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99769,9 +99769,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99806,9 +99806,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99843,9 +99843,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99880,9 +99880,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99917,9 +99917,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99954,9 +99954,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -99991,9 +99991,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100028,9 +100028,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100065,9 +100065,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100102,9 +100102,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100139,9 +100139,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100176,9 +100176,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100213,9 +100213,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100250,9 +100250,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100287,9 +100287,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100324,9 +100324,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100361,9 +100361,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100398,9 +100398,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100435,9 +100435,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100472,9 +100472,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100509,9 +100509,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100546,9 +100546,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100583,9 +100583,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100620,9 +100620,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100657,9 +100657,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100694,9 +100694,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100731,9 +100731,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100768,9 +100768,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100805,9 +100805,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100842,9 +100842,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100879,9 +100879,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100916,9 +100916,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100953,9 +100953,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -100990,9 +100990,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101027,9 +101027,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101064,9 +101064,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101101,9 +101101,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101138,9 +101138,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101175,9 +101175,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101212,9 +101212,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101249,9 +101249,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101286,9 +101286,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101323,9 +101323,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101360,9 +101360,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101397,9 +101397,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101434,9 +101434,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101471,9 +101471,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101508,9 +101508,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101545,9 +101545,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101582,9 +101582,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101619,9 +101619,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101656,9 +101656,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101693,9 +101693,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101730,9 +101730,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101767,9 +101767,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101804,9 +101804,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101841,9 +101841,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101878,9 +101878,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101915,9 +101915,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101952,9 +101952,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -101989,9 +101989,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102026,9 +102026,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102063,9 +102063,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102100,9 +102100,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102137,9 +102137,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102174,9 +102174,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102211,9 +102211,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102248,9 +102248,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102285,9 +102285,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102322,9 +102322,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102359,9 +102359,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102396,9 +102396,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102433,9 +102433,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102470,9 +102470,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102507,9 +102507,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102544,9 +102544,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102581,9 +102581,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102618,9 +102618,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102655,9 +102655,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102692,9 +102692,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102729,9 +102729,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102766,9 +102766,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102803,9 +102803,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102840,9 +102840,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102877,9 +102877,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102914,9 +102914,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102951,9 +102951,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -102988,9 +102988,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103025,9 +103025,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103062,9 +103062,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103099,9 +103099,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103136,9 +103136,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103173,9 +103173,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103210,9 +103210,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103247,9 +103247,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103284,9 +103284,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103321,9 +103321,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103358,9 +103358,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103395,9 +103395,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103432,9 +103432,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103469,9 +103469,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103506,9 +103506,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103543,9 +103543,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103580,9 +103580,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103617,9 +103617,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103654,9 +103654,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103691,9 +103691,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103728,9 +103728,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103765,9 +103765,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103802,9 +103802,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103839,9 +103839,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103876,9 +103876,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103913,9 +103913,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103950,9 +103950,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -103987,9 +103987,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104024,9 +104024,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104061,9 +104061,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104098,9 +104098,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104135,9 +104135,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104172,9 +104172,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104209,9 +104209,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104246,9 +104246,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104283,9 +104283,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104320,9 +104320,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104357,9 +104357,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104394,9 +104394,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104431,9 +104431,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104468,9 +104468,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104505,9 +104505,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104542,9 +104542,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104579,9 +104579,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104616,9 +104616,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104653,9 +104653,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104690,9 +104690,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104727,9 +104727,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104764,9 +104764,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104801,9 +104801,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104838,9 +104838,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104875,9 +104875,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104912,9 +104912,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104949,9 +104949,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -104986,9 +104986,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105023,9 +105023,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105060,9 +105060,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105097,9 +105097,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105134,9 +105134,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105171,9 +105171,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105208,9 +105208,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105245,9 +105245,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105282,9 +105282,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105319,9 +105319,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105356,9 +105356,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105393,9 +105393,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105430,9 +105430,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105467,9 +105467,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105504,9 +105504,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105541,9 +105541,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105578,9 +105578,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105615,9 +105615,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105652,9 +105652,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105689,9 +105689,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105726,9 +105726,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105763,9 +105763,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105800,9 +105800,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105837,9 +105837,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105874,9 +105874,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105911,9 +105911,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105948,9 +105948,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -105985,9 +105985,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106022,9 +106022,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106059,9 +106059,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106096,9 +106096,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106133,9 +106133,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106170,9 +106170,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106207,9 +106207,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106244,9 +106244,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106281,9 +106281,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106318,9 +106318,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106355,9 +106355,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106392,9 +106392,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106429,9 +106429,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106466,9 +106466,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106503,9 +106503,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106540,9 +106540,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106577,9 +106577,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106614,9 +106614,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106651,9 +106651,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106688,9 +106688,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106725,9 +106725,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106762,9 +106762,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106799,9 +106799,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106836,9 +106836,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106873,9 +106873,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106910,9 +106910,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106947,9 +106947,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -106984,9 +106984,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107021,9 +107021,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107058,9 +107058,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107095,9 +107095,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107132,9 +107132,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107169,9 +107169,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107206,9 +107206,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107243,9 +107243,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107280,9 +107280,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107317,9 +107317,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107354,9 +107354,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107391,9 +107391,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107428,9 +107428,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107465,9 +107465,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107502,9 +107502,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107539,9 +107539,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107576,9 +107576,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107613,9 +107613,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107650,9 +107650,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107687,9 +107687,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107724,9 +107724,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107761,9 +107761,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107798,9 +107798,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107835,9 +107835,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107872,9 +107872,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107909,9 +107909,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107946,9 +107946,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -107983,9 +107983,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108020,9 +108020,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108057,9 +108057,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108094,9 +108094,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108131,9 +108131,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108168,9 +108168,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108205,9 +108205,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108242,9 +108242,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108279,9 +108279,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108316,9 +108316,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108353,9 +108353,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108390,9 +108390,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108427,9 +108427,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108464,9 +108464,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108501,9 +108501,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108538,9 +108538,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108575,9 +108575,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108612,9 +108612,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108649,9 +108649,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108686,9 +108686,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108723,9 +108723,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108760,9 +108760,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108797,9 +108797,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108834,9 +108834,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108871,9 +108871,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108908,9 +108908,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108945,9 +108945,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -108982,9 +108982,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109019,9 +109019,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109056,9 +109056,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109093,9 +109093,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109130,9 +109130,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109167,9 +109167,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109204,9 +109204,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109241,9 +109241,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109278,9 +109278,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109315,9 +109315,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109352,9 +109352,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109389,9 +109389,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109426,9 +109426,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109463,9 +109463,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109500,9 +109500,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109537,9 +109537,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109574,9 +109574,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109611,9 +109611,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109648,9 +109648,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109685,9 +109685,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109722,9 +109722,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109759,9 +109759,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109796,9 +109796,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109833,9 +109833,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109870,9 +109870,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109907,9 +109907,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109944,9 +109944,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -109981,9 +109981,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110018,9 +110018,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110055,9 +110055,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110092,9 +110092,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110129,9 +110129,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110166,9 +110166,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110203,9 +110203,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110240,9 +110240,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110277,9 +110277,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110314,9 +110314,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110351,9 +110351,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110388,9 +110388,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110425,9 +110425,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110462,9 +110462,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110499,9 +110499,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110536,9 +110536,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110573,9 +110573,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110610,9 +110610,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110647,9 +110647,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110684,9 +110684,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110721,9 +110721,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110758,9 +110758,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110795,9 +110795,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110832,9 +110832,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110869,9 +110869,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110906,9 +110906,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110943,9 +110943,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -110980,9 +110980,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111017,9 +111017,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111054,9 +111054,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111091,9 +111091,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111128,9 +111128,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111165,9 +111165,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111202,9 +111202,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111239,9 +111239,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111276,9 +111276,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111313,9 +111313,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111350,9 +111350,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111387,9 +111387,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111424,9 +111424,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111461,9 +111461,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111498,9 +111498,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111535,9 +111535,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111572,9 +111572,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111609,9 +111609,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111646,9 +111646,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111683,9 +111683,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111720,9 +111720,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111757,9 +111757,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111794,9 +111794,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111831,9 +111831,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111868,9 +111868,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -111905,9 +111905,9 @@ }, { "techniqueID": "T1218.011", - "score": 12, + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { "techniqueID": "T1074.001", @@ -165156,91 +165156,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -165322,2000 +165240,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -167397,91 +165324,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1065", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1088", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1048.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" - }, - { - "techniqueID": "T1132.001", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.007", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1590.002", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1548.002", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" - }, - { - "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" - }, - { - "techniqueID": "T1003.004", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1137", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1106", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1219", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1117", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1090", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1102", - "score": 8, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -167563,8 +165408,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -167646,8 +165492,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -167729,8 +165576,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -167812,8 +165660,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -167895,9 +165744,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -167978,9 +165912,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -168061,9 +166080,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -168144,8 +166248,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168227,8 +166332,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168310,8 +166416,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168393,8 +166500,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168476,8 +166584,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168559,8 +166668,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168642,8 +166752,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168725,8 +166836,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168808,8 +166920,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168891,8 +167004,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -168974,8 +167088,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169057,8 +167172,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169140,8 +167256,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169223,8 +167340,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169306,8 +167424,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169389,8 +167508,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169472,8 +167592,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169555,8 +167676,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169638,8 +167760,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169721,8 +167844,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169804,8 +167928,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169887,8 +168012,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -169970,8 +168096,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170053,9 +168180,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -170136,9 +168348,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -170219,8 +168516,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170302,8 +168600,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170385,8 +168684,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170468,8 +168768,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170551,8 +168852,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170634,8 +168936,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170717,8 +169020,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170800,8 +169104,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170883,8 +169188,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -170966,8 +169272,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171049,8 +169356,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171132,8 +169440,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171215,8 +169524,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171298,8 +169608,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171381,8 +169692,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171464,8 +169776,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171547,8 +169860,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171630,8 +169944,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171713,8 +170028,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171796,8 +170112,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171879,8 +170196,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -171962,8 +170280,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172045,8 +170364,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172128,9 +170448,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -172211,9 +170616,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -172294,8 +170784,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172377,8 +170868,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172460,8 +170952,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172543,8 +171036,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172626,8 +171120,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172709,8 +171204,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172792,8 +171288,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172875,8 +171372,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -172958,8 +171456,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173041,8 +171540,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173124,8 +171624,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173207,8 +171708,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173290,8 +171792,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173373,8 +171876,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173456,8 +171960,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173539,8 +172044,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173622,8 +172128,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173705,8 +172212,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173788,8 +172296,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173871,8 +172380,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -173954,8 +172464,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174037,8 +172548,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174120,8 +172632,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174203,9 +172716,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -174286,9 +172884,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -174369,8 +173052,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174452,8 +173136,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174535,8 +173220,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174618,8 +173304,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174701,8 +173388,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174784,8 +173472,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174867,8 +173556,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -174950,8 +173640,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175033,8 +173724,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175116,8 +173808,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175199,8 +173892,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175282,8 +173976,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175365,8 +174060,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175448,8 +174144,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175531,8 +174228,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175614,8 +174312,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175697,8 +174396,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175780,8 +174480,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175863,8 +174564,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -175946,8 +174648,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176029,8 +174732,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176112,8 +174816,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176195,8 +174900,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176278,9 +174984,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -176361,9 +175152,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -176444,8 +175320,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176527,8 +175404,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176610,8 +175488,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176693,8 +175572,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176776,8 +175656,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176859,8 +175740,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -176942,8 +175824,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177025,8 +175908,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177108,8 +175992,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177191,8 +176076,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177274,8 +176160,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177357,8 +176244,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177440,8 +176328,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177523,8 +176412,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177606,8 +176496,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177689,8 +176580,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177772,8 +176664,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177855,8 +176748,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -177938,8 +176832,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178021,8 +176916,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178104,8 +177000,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178187,8 +177084,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178270,8 +177168,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178353,9 +177252,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -178436,9 +177420,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -178519,8 +177588,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178602,8 +177672,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178685,8 +177756,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178768,8 +177840,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178851,8 +177924,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -178934,8 +178008,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179017,8 +178092,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179100,8 +178176,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179183,8 +178260,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179266,8 +178344,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179349,8 +178428,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179432,8 +178512,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179515,8 +178596,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179598,8 +178680,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179681,8 +178764,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179764,8 +178848,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179847,8 +178932,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -179930,8 +179016,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180013,8 +179100,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180096,8 +179184,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180179,8 +179268,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180262,8 +179352,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180345,8 +179436,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180428,9 +179520,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -180511,9 +179688,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -180594,8 +179856,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180677,8 +179940,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180760,8 +180024,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180843,8 +180108,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -180926,8 +180192,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181009,8 +180276,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181092,8 +180360,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181175,8 +180444,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181258,8 +180528,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181341,8 +180612,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181424,8 +180696,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181507,8 +180780,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181590,8 +180864,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181673,8 +180948,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181756,8 +181032,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181839,8 +181116,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -181922,8 +181200,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182005,8 +181284,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182088,8 +181368,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182171,8 +181452,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182254,8 +181536,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182337,8 +181620,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182420,8 +181704,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182503,9 +181788,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -182586,9 +181956,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -182669,8 +182124,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182752,8 +182208,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182835,8 +182292,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -182918,8 +182376,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183001,8 +182460,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183084,8 +182544,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183167,8 +182628,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183250,8 +182712,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183333,8 +182796,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183416,8 +182880,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183499,8 +182964,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183582,8 +183048,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183665,8 +183132,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183748,8 +183216,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183831,8 +183300,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183914,8 +183384,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -183997,8 +183468,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184080,8 +183552,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184163,8 +183636,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184246,8 +183720,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184329,8 +183804,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184412,8 +183888,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184495,8 +183972,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184578,9 +184056,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -184661,9 +184224,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -184744,8 +184392,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184827,8 +184476,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184910,8 +184560,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -184993,8 +184644,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185076,8 +184728,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185159,8 +184812,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185242,8 +184896,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185325,8 +184980,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185408,8 +185064,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185491,8 +185148,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185574,8 +185232,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185657,8 +185316,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185740,8 +185400,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185823,8 +185484,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185906,8 +185568,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -185989,8 +185652,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186072,8 +185736,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186155,8 +185820,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186238,8 +185904,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186321,8 +185988,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186404,8 +186072,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186487,8 +186156,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186570,8 +186240,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186653,9 +186324,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -186736,9 +186492,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -186819,8 +186660,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186902,8 +186744,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -186985,8 +186828,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187068,8 +186912,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187151,8 +186996,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187234,8 +187080,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187317,8 +187164,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187400,8 +187248,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187483,8 +187332,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187566,8 +187416,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187649,8 +187500,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187732,8 +187584,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187815,8 +187668,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187898,8 +187752,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -187981,8 +187836,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188064,8 +187920,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188147,8 +188004,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188230,8 +188088,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188313,8 +188172,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188396,8 +188256,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188479,8 +188340,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188562,8 +188424,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188645,8 +188508,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188728,9 +188592,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -188811,9 +188760,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -188894,8 +188928,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -188977,8 +189012,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189060,8 +189096,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189143,8 +189180,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189226,8 +189264,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189309,8 +189348,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189392,8 +189432,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189475,8 +189516,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189558,8 +189600,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189641,8 +189684,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189724,8 +189768,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189807,8 +189852,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189890,8 +189936,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -189973,8 +190020,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190056,8 +190104,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190139,8 +190188,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190222,8 +190272,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190305,8 +190356,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190388,8 +190440,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190471,8 +190524,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190554,8 +190608,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190637,8 +190692,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190720,8 +190776,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -190803,9 +190860,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -190886,9 +191028,94 @@ }, { "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, + { + "techniqueID": "T1065", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1088", "score": 8, "showSubtechniques": false }, + { + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + }, + { + "techniqueID": "T1132.001", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" + }, + { + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1137", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1106", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1219", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1117", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + }, { "techniqueID": "T1065", "score": 8, @@ -190969,8 +191196,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191052,8 +191280,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191135,8 +191364,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191218,8 +191448,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191301,8 +191532,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191384,8 +191616,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191467,8 +191700,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191550,8 +191784,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191633,8 +191868,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191716,8 +191952,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191799,8 +192036,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191882,8 +192120,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -191965,8 +192204,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192048,8 +192288,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192131,8 +192372,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192214,8 +192456,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192297,8 +192540,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192380,8 +192624,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192463,8 +192708,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192546,8 +192792,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192629,8 +192876,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192712,8 +192960,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192795,8 +193044,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192878,8 +193128,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -192961,8 +193212,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193044,8 +193296,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193127,8 +193380,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193210,8 +193464,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193293,8 +193548,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193376,8 +193632,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193459,8 +193716,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193542,8 +193800,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193625,8 +193884,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193708,8 +193968,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193791,8 +194052,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193874,8 +194136,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -193957,8 +194220,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -194040,8 +194304,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -194123,8 +194388,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -194206,8 +194472,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -194289,8 +194556,9 @@ }, { "techniqueID": "T1218.010", - "score": 8, - "showSubtechniques": false + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { "techniqueID": "T1065", @@ -194309,108 +194577,88 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1066", - "score": 7, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.002", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" - }, - { - "techniqueID": "T1587.001", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1573.001", - "score": 7, + "techniqueID": "T1059.007", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1069.002", - "score": 7, + "techniqueID": "T1590.002", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1021.004", + "techniqueID": "T1548.002", "score": 7, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml" }, { - "techniqueID": "T1007", - "score": 7, - "showSubtechniques": false + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" }, { - "techniqueID": "T1071", - "score": 7, + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1547.009", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070.001", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" - }, - { - "techniqueID": "T1588.001", - "score": 7, + "techniqueID": "T1106", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" - }, - { - "techniqueID": "T1552.001", - "score": 7, + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1023", - "score": 7, + "techniqueID": "T1117", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1098", - "score": 7, + "techniqueID": "T1090", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1027.005", - "score": 7, + "techniqueID": "T1102", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1114.002", + "techniqueID": "T1218.010", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1012", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1221", - "score": 7, + "techniqueID": "T1088", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1134", - "score": 7, - "showSubtechniques": false + "techniqueID": "T1048.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { "techniqueID": "T1066", @@ -230917,287 +231165,109 @@ "showSubtechniques": false }, { - "techniqueID": "T1037", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1099", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1069", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1074.002", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1070.006", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1009", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.004", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" - }, - { - "techniqueID": "T1027.001", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.005", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" - }, - { - "techniqueID": "T1546.003", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" - }, - { - "techniqueID": "T1170", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.003", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.006", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1194", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1084", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1001.002", - "score": 6, + "techniqueID": "T1066", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1055.001", + "techniqueID": "T1003.002", "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1566.003", - "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { - "techniqueID": "T1037", - "score": 6, + "techniqueID": "T1587.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1099", - "score": 6, + "techniqueID": "T1573.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1069", - "score": 6, + "techniqueID": "T1069.002", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1074.002", - "score": 6, + "techniqueID": "T1021.004", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1070.006", - "score": 6, + "techniqueID": "T1007", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1009", - "score": 6, + "techniqueID": "T1071", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1562.004", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" - }, - { - "techniqueID": "T1027.001", - "score": 6, + "techniqueID": "T1547.009", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1218.005", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" - }, - { - "techniqueID": "T1546.003", + "techniqueID": "T1070.001", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" - }, - { - "techniqueID": "T1170", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.003", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.006", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1194", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1084", - "score": 6, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" }, { - "techniqueID": "T1001.002", - "score": 6, + "techniqueID": "T1588.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1055.001", + "techniqueID": "T1070", "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1566.003", - "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" - }, - { - "techniqueID": "T1037", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1099", - "score": 6, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" }, { - "techniqueID": "T1069", - "score": 6, + "techniqueID": "T1552.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1074.002", - "score": 6, + "techniqueID": "T1023", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1070.006", - "score": 6, + "techniqueID": "T1098", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1009", - "score": 6, + "techniqueID": "T1027.005", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1562.004", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" - }, - { - "techniqueID": "T1027.001", + "techniqueID": "T1114.002", "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.005", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" - }, - { - "techniqueID": "T1546.003", - "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" - }, - { - "techniqueID": "T1170", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.003", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.006", - "score": 6, - "showSubtechniques": false - }, - { - "techniqueID": "T1194", - "score": 6, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" }, { - "techniqueID": "T1084", - "score": 6, + "techniqueID": "T1012", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1001.002", - "score": 6, + "techniqueID": "T1221", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1055.001", - "score": 6, + "techniqueID": "T1134", + "score": 7, "showSubtechniques": false }, - { - "techniqueID": "T1566.003", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" - }, { "techniqueID": "T1037", "score": 6, @@ -264005,404 +264075,286 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, + "techniqueID": "T1037", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1566", - "score": 5, + "techniqueID": "T1099", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1218.001", - "score": 5, + "techniqueID": "T1069", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1195.002", - "score": 5, + "techniqueID": "T1074.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1573.002", - "score": 5, + "techniqueID": "T1070.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1075", - "score": 5, + "techniqueID": "T1009", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.002", - "score": 3, + "techniqueID": "T1562.004", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1158", - "score": 5, + "techniqueID": "T1027.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, + "techniqueID": "T1218.005", + "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" }, { - "techniqueID": "T1102.001", + "techniqueID": "T1546.003", "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", - "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" }, { - "techniqueID": "T1040", - "score": 5, + "techniqueID": "T1170", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1120", - "score": 5, + "techniqueID": "T1027.003", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550", - "score": 5, + "techniqueID": "T1059.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 5, + "techniqueID": "T1194", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1020", - "score": 5, + "techniqueID": "T1084", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1015", - "score": 5, + "techniqueID": "T1001.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1566", - "score": 5, + "techniqueID": "T1055.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1218.001", + "techniqueID": "T1566.003", "score": 5, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1195.002", - "score": 5, + "techniqueID": "T1037", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1573.002", - "score": 5, + "techniqueID": "T1099", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1075", - "score": 5, + "techniqueID": "T1069", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, + "techniqueID": "T1074.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1158", - "score": 5, + "techniqueID": "T1070.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, + "techniqueID": "T1009", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.003", + "techniqueID": "T1562.004", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1040", - "score": 5, + "techniqueID": "T1027.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false + "techniqueID": "T1218.005", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" }, { - "techniqueID": "T1550", + "techniqueID": "T1546.003", "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" }, { - "techniqueID": "T1087", - "score": 5, + "techniqueID": "T1170", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1020", - "score": 5, + "techniqueID": "T1027.003", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1015", - "score": 5, + "techniqueID": "T1059.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1566", - "score": 5, + "techniqueID": "T1194", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1218.001", - "score": 5, + "techniqueID": "T1084", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1195.002", - "score": 5, + "techniqueID": "T1001.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1573.002", - "score": 5, + "techniqueID": "T1055.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1075", + "techniqueID": "T1566.003", "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1223", - "score": 5, + "techniqueID": "T1037", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1158", - "score": 5, + "techniqueID": "T1099", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, + "techniqueID": "T1069", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, + "techniqueID": "T1074.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1120", - "score": 5, + "techniqueID": "T1070.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550", - "score": 5, + "techniqueID": "T1009", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1546.008", + "techniqueID": "T1562.004", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1087", - "score": 5, + "techniqueID": "T1027.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false + "techniqueID": "T1218.005", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" }, { - "techniqueID": "T1015", + "techniqueID": "T1546.003", "score": 5, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" }, { - "techniqueID": "T1566", - "score": 5, + "techniqueID": "T1170", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1218.001", - "score": 5, + "techniqueID": "T1027.003", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1195.002", - "score": 5, + "techniqueID": "T1059.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1573.002", - "score": 5, + "techniqueID": "T1194", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1075", - "score": 5, + "techniqueID": "T1084", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, + "techniqueID": "T1001.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1158", - "score": 5, + "techniqueID": "T1055.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", + "techniqueID": "T1566.003", "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", - "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { "techniqueID": "T1040", @@ -264447,8 +264399,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -264547,108 +264500,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -264747,108 +264601,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -264947,8 +264702,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265047,8 +264803,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265147,8 +264904,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265247,8 +265005,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265347,8 +265106,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265447,8 +265207,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265547,8 +265308,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265647,8 +265409,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265747,8 +265510,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265847,8 +265611,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -265947,8 +265712,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266047,8 +265813,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266147,8 +265914,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266247,8 +266015,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266347,8 +266116,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266447,8 +266217,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266547,8 +266318,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266647,8 +266419,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266747,8 +266520,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266847,8 +266621,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -266947,8 +266722,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267047,8 +266823,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267147,8 +266924,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267247,8 +267025,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267347,8 +267126,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267447,8 +267227,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267547,8 +267328,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267647,8 +267429,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267747,8 +267530,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267847,8 +267631,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -267947,8 +267732,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268047,8 +267833,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268147,8 +267934,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268247,8 +268035,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268347,8 +268136,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268447,8 +268237,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268547,8 +268338,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268647,8 +268439,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268747,8 +268540,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268847,8 +268641,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -268947,8 +268742,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269047,8 +268843,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269147,8 +268944,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269247,8 +269045,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269347,8 +269146,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269447,8 +269247,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269547,8 +269348,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269647,8 +269449,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269747,8 +269550,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269847,8 +269651,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -269947,8 +269752,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270047,8 +269853,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270147,8 +269954,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270247,8 +270055,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270347,8 +270156,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270447,8 +270257,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270547,8 +270358,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270647,8 +270459,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270747,8 +270560,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270847,8 +270661,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -270947,8 +270762,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271047,8 +270863,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271147,8 +270964,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271247,8 +271065,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271347,8 +271166,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271447,8 +271267,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271547,8 +271368,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271647,8 +271469,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271747,8 +271570,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271847,8 +271671,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -271947,8 +271772,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272047,8 +271873,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272147,9 +271974,111 @@ }, { "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1020", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", "score": 5, "showSubtechniques": false }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1195.002", "score": 5, @@ -272247,8 +272176,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272347,8 +272277,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272447,8 +272378,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272547,8 +272479,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272647,8 +272580,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272747,8 +272681,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272847,8 +272782,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -272947,8 +272883,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273047,8 +272984,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273147,8 +273085,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273247,8 +273186,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273347,8 +273287,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273447,8 +273388,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273547,8 +273489,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273647,8 +273590,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273747,8 +273691,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273847,8 +273792,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -273947,8 +273893,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274047,8 +273994,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274147,8 +274095,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274247,8 +274196,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274347,8 +274297,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274447,8 +274398,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274547,8 +274499,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274647,8 +274600,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274747,8 +274701,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274847,8 +274802,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -274947,8 +274903,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275047,8 +275004,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275147,8 +275105,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275247,8 +275206,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275347,8 +275307,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275447,8 +275408,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275547,8 +275509,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275647,8 +275610,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275747,8 +275711,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275847,8 +275812,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -275947,8 +275913,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276047,8 +276014,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276147,8 +276115,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276247,8 +276216,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276347,8 +276317,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276447,8 +276418,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276547,8 +276519,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276647,8 +276620,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276747,8 +276721,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276847,8 +276822,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -276947,8 +276923,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277047,8 +277024,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277147,8 +277125,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277247,8 +277226,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277347,8 +277327,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277447,8 +277428,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277547,9 +277529,111 @@ }, { "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1020", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", "score": 5, "showSubtechniques": false }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1195.002", "score": 5, @@ -277647,8 +277731,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277747,8 +277832,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277847,8 +277933,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -277947,8 +278034,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278047,8 +278135,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278147,8 +278236,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278247,8 +278337,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278347,8 +278438,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278447,8 +278539,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278547,8 +278640,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278647,8 +278741,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278747,8 +278842,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278847,8 +278943,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -278947,8 +279044,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279047,8 +279145,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279147,8 +279246,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279247,8 +279347,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279347,8 +279448,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279447,8 +279549,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279547,8 +279650,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279647,8 +279751,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279747,8 +279852,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279847,8 +279953,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -279947,8 +280054,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280047,8 +280155,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280147,8 +280256,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280247,8 +280357,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280347,8 +280458,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280447,8 +280559,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280547,8 +280660,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280647,8 +280761,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280747,8 +280862,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280847,8 +280963,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -280947,8 +281064,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281047,8 +281165,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281147,8 +281266,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281247,8 +281367,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281347,8 +281468,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281447,8 +281569,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281547,8 +281670,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281647,8 +281771,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281747,8 +281872,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281847,8 +281973,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -281947,8 +282074,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282047,8 +282175,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282147,8 +282276,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282247,8 +282377,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282347,8 +282478,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282447,8 +282579,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282547,8 +282680,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282647,8 +282781,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282747,8 +282882,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282847,8 +282983,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -282947,9 +283084,111 @@ }, { "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1020", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", "score": 5, "showSubtechniques": false }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1195.002", "score": 5, @@ -283047,8 +283286,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283147,8 +283387,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283247,8 +283488,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283347,8 +283589,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283447,8 +283690,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283547,8 +283791,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283647,8 +283892,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283747,8 +283993,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283847,8 +284094,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -283947,8 +284195,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284047,8 +284296,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284147,8 +284397,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284247,8 +284498,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284347,8 +284599,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284447,8 +284700,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284547,8 +284801,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284647,8 +284902,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284747,8 +285003,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284847,8 +285104,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -284947,8 +285205,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285047,8 +285306,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285147,8 +285407,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285247,8 +285508,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285347,8 +285609,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285447,8 +285710,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285547,8 +285811,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285647,8 +285912,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285747,8 +286013,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285847,8 +286114,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -285947,8 +286215,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286047,8 +286316,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286147,8 +286417,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286247,8 +286518,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286347,8 +286619,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286447,8 +286720,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286547,8 +286821,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286647,8 +286922,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286747,8 +287023,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286847,8 +287124,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -286947,8 +287225,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287047,8 +287326,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287147,8 +287427,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287247,8 +287528,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287347,8 +287629,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287447,8 +287730,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287547,8 +287831,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287647,8 +287932,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287747,8 +288033,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287847,8 +288134,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -287947,8 +288235,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288047,8 +288336,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288147,8 +288437,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288247,8 +288538,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288347,9 +288639,111 @@ }, { "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1020", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", "score": 5, "showSubtechniques": false }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1195.002", "score": 5, @@ -288447,8 +288841,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288547,8 +288942,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288647,8 +289043,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288747,8 +289144,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288847,8 +289245,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -288947,8 +289346,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289047,8 +289447,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289147,8 +289548,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289247,8 +289649,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289347,8 +289750,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289447,8 +289851,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289547,8 +289952,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289647,8 +290053,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289747,8 +290154,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289847,8 +290255,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -289947,8 +290356,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290047,8 +290457,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290147,8 +290558,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290247,8 +290659,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290347,8 +290760,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290447,8 +290861,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290547,8 +290962,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290647,8 +291063,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290747,8 +291164,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290847,8 +291265,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -290947,8 +291366,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291047,8 +291467,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291147,8 +291568,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291247,8 +291669,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291347,8 +291770,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291447,8 +291871,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291547,8 +291972,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291647,8 +292073,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291747,8 +292174,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291847,8 +292275,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -291947,8 +292376,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292047,8 +292477,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292147,8 +292578,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292247,8 +292679,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292347,8 +292780,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292447,8 +292881,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292547,8 +292982,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292647,8 +293083,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292747,8 +293184,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292847,8 +293285,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -292947,8 +293386,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293047,8 +293487,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293147,8 +293588,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293247,8 +293689,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293347,8 +293790,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293447,8 +293891,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293547,8 +293992,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293647,8 +294093,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293747,9 +294194,111 @@ }, { "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1020", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", "score": 5, "showSubtechniques": false }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1195.002", "score": 5, @@ -293847,8 +294396,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -293947,8 +294497,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294047,8 +294598,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294147,8 +294699,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294247,8 +294800,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294347,8 +294901,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294447,8 +295002,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294547,8 +295103,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294647,8 +295204,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294747,8 +295305,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294847,8 +295406,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -294947,8 +295507,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295047,8 +295608,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295147,8 +295709,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295247,8 +295810,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295347,8 +295911,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295447,8 +296012,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295547,8 +296113,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295647,8 +296214,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295747,8 +296315,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295847,8 +296416,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -295947,8 +296517,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296047,8 +296618,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296147,8 +296719,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296247,8 +296820,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296347,8 +296921,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296447,8 +297022,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296547,8 +297123,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296647,8 +297224,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296747,8 +297325,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296847,8 +297426,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -296947,8 +297527,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297047,8 +297628,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297147,8 +297729,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297247,8 +297830,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297347,8 +297931,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297447,8 +298032,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297547,8 +298133,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297647,8 +298234,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297747,8 +298335,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297847,8 +298436,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -297947,8 +298537,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298047,8 +298638,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298147,8 +298739,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298247,8 +298840,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298347,8 +298941,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298447,8 +299042,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298547,8 +299143,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298647,8 +299244,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298747,8 +299345,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298847,8 +299446,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -298947,8 +299547,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -299047,8 +299648,9 @@ }, { "techniqueID": "T1218.001", - "score": 5, - "showSubtechniques": false + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { "techniqueID": "T1195.002", @@ -299147,9 +299749,111 @@ }, { "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1075", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1158", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1078.003", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1120", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1550", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1546.008", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1020", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", "score": 5, "showSubtechniques": false }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, { "techniqueID": "T1195.002", "score": 5, @@ -299297,9 +300001,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -299329,9 +300033,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -299436,9 +300140,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -299468,9 +300172,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -299575,9 +300279,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -299607,9 +300311,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -299714,9 +300418,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -299746,9 +300450,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -299853,9 +300557,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -299885,9 +300589,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -299992,9 +300696,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300024,9 +300728,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300131,9 +300835,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300163,9 +300867,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300270,9 +300974,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300302,9 +301006,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300409,9 +301113,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300441,9 +301145,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300548,9 +301252,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300580,9 +301284,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300687,9 +301391,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300719,9 +301423,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300826,9 +301530,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300858,9 +301562,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -300965,9 +301669,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -300997,9 +301701,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301104,9 +301808,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301136,9 +301840,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301243,9 +301947,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301275,9 +301979,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301382,9 +302086,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301414,9 +302118,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301521,9 +302225,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301553,9 +302257,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301660,9 +302364,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301692,9 +302396,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301799,9 +302503,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301831,9 +302535,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -301938,9 +302642,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -301970,9 +302674,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302077,9 +302781,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302109,9 +302813,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302216,9 +302920,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302248,9 +302952,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302355,9 +303059,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302387,9 +303091,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302494,9 +303198,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302526,9 +303230,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302633,9 +303337,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302665,9 +303369,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302772,9 +303476,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302804,9 +303508,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -302911,9 +303615,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -302943,9 +303647,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303050,9 +303754,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303082,9 +303786,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303189,9 +303893,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303221,9 +303925,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303328,9 +304032,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303360,9 +304064,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303467,9 +304171,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303499,9 +304203,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303606,9 +304310,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303638,9 +304342,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303745,9 +304449,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303777,9 +304481,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -303884,9 +304588,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -303916,9 +304620,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304023,9 +304727,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304055,9 +304759,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304162,9 +304866,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304194,9 +304898,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304301,9 +305005,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304333,9 +305037,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304440,9 +305144,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304472,9 +305176,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304579,9 +305283,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304611,9 +305315,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304718,9 +305422,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304750,9 +305454,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304857,9 +305561,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -304889,9 +305593,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -304996,9 +305700,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305028,9 +305732,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305135,9 +305839,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305167,9 +305871,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305274,9 +305978,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305306,9 +306010,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305413,9 +306117,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305445,9 +306149,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305552,9 +306256,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305584,9 +306288,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305691,9 +306395,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305723,9 +306427,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305830,9 +306534,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -305862,9 +306566,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -305969,9 +306673,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306001,9 +306705,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306108,9 +306812,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306140,9 +306844,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306247,9 +306951,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306279,9 +306983,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306386,9 +307090,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306418,9 +307122,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306525,9 +307229,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306557,9 +307261,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306664,9 +307368,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306696,9 +307400,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306803,9 +307507,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306835,9 +307539,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -306942,9 +307646,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306974,9 +307678,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307081,9 +307785,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307113,9 +307817,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307220,9 +307924,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307252,9 +307956,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307359,9 +308063,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307391,9 +308095,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307498,9 +308202,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307530,9 +308234,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307637,9 +308341,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307669,9 +308373,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307776,9 +308480,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307808,9 +308512,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -307915,9 +308619,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307947,9 +308651,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308054,9 +308758,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308086,9 +308790,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308193,9 +308897,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308225,9 +308929,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308332,9 +309036,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308364,9 +309068,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308471,9 +309175,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308503,9 +309207,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308610,9 +309314,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308642,9 +309346,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308749,9 +309453,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308781,9 +309485,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -308888,9 +309592,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308920,9 +309624,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309027,9 +309731,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309059,9 +309763,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309166,9 +309870,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309198,9 +309902,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309305,9 +310009,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309337,9 +310041,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309444,9 +310148,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309476,9 +310180,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309583,9 +310287,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309615,9 +310319,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309722,9 +310426,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309754,9 +310458,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -309861,9 +310565,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309893,9 +310597,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310000,9 +310704,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310032,9 +310736,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310139,9 +310843,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310171,9 +310875,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310278,9 +310982,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310310,9 +311014,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310417,9 +311121,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310449,9 +311153,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310556,9 +311260,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310588,9 +311292,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310695,9 +311399,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310727,9 +311431,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310834,9 +311538,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310866,9 +311570,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -310973,9 +311677,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311005,9 +311709,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311112,9 +311816,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311144,9 +311848,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311251,9 +311955,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311283,9 +311987,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311390,9 +312094,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311422,9 +312126,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311529,9 +312233,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311561,9 +312265,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311668,9 +312372,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311700,9 +312404,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311807,9 +312511,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311839,9 +312543,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -311946,9 +312650,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311978,9 +312682,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312085,9 +312789,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312117,9 +312821,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312224,9 +312928,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312256,9 +312960,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312363,9 +313067,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312395,9 +313099,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312502,9 +313206,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312534,9 +313238,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312641,9 +313345,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312673,9 +313377,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312780,9 +313484,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312812,9 +313516,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -312919,9 +313623,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312951,9 +313655,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313058,9 +313762,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313090,9 +313794,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313197,9 +313901,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313229,9 +313933,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313336,9 +314040,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313368,9 +314072,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313475,9 +314179,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313507,9 +314211,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313614,9 +314318,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313646,9 +314350,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313753,9 +314457,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313785,9 +314489,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -313892,9 +314596,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313924,9 +314628,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314031,9 +314735,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314063,9 +314767,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314170,9 +314874,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314202,9 +314906,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314309,9 +315013,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314341,9 +315045,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314448,9 +315152,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314480,9 +315184,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314587,9 +315291,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314619,9 +315323,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314726,9 +315430,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314758,9 +315462,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -314865,9 +315569,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314897,9 +315601,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315004,9 +315708,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315036,9 +315740,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315143,9 +315847,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315175,9 +315879,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315282,9 +315986,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315314,9 +316018,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315421,9 +316125,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315453,9 +316157,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315560,9 +316264,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315592,9 +316296,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315699,9 +316403,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315731,9 +316435,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315838,9 +316542,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315870,9 +316574,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -315977,9 +316681,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316009,9 +316713,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316116,9 +316820,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316148,9 +316852,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316255,9 +316959,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316287,9 +316991,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316394,9 +317098,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316426,9 +317130,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316533,9 +317237,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316565,9 +317269,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316672,9 +317376,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316704,9 +317408,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316811,9 +317515,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316843,9 +317547,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -316950,9 +317654,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316982,9 +317686,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317089,9 +317793,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317121,9 +317825,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317228,9 +317932,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317260,9 +317964,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317367,9 +318071,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317399,9 +318103,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317506,9 +318210,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317538,9 +318242,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317645,9 +318349,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317677,9 +318381,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317784,9 +318488,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317816,9 +318520,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -317923,9 +318627,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317955,9 +318659,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318062,9 +318766,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318094,9 +318798,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318201,9 +318905,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318233,9 +318937,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318340,9 +319044,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318372,9 +319076,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318479,9 +319183,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318511,9 +319215,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318618,9 +319322,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318650,9 +319354,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318757,9 +319461,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318789,9 +319493,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -318896,9 +319600,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318928,9 +319632,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319035,9 +319739,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319067,9 +319771,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319174,9 +319878,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319206,9 +319910,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319313,9 +320017,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319345,9 +320049,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319452,9 +320156,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319484,9 +320188,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319591,9 +320295,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319623,9 +320327,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319730,9 +320434,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319762,9 +320466,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -319869,9 +320573,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319901,9 +320605,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320008,9 +320712,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320040,9 +320744,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320147,9 +320851,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320179,9 +320883,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320286,9 +320990,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320318,9 +321022,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320425,9 +321129,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320457,9 +321161,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320564,9 +321268,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320596,9 +321300,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320703,9 +321407,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320735,9 +321439,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320842,9 +321546,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320874,9 +321578,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -320981,9 +321685,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321013,9 +321717,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321120,9 +321824,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321152,9 +321856,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321259,9 +321963,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321291,9 +321995,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321398,9 +322102,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321430,9 +322134,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321537,9 +322241,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321569,9 +322273,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321676,9 +322380,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321708,9 +322412,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321815,9 +322519,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321847,9 +322551,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -321954,9 +322658,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321986,9 +322690,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322093,9 +322797,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322125,9 +322829,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322232,9 +322936,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322264,9 +322968,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322371,9 +323075,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322403,9 +323107,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322510,9 +323214,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322542,9 +323246,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322649,9 +323353,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322681,9 +323385,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322788,9 +323492,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322820,9 +323524,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -322927,9 +323631,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322959,9 +323663,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323066,9 +323770,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323098,9 +323802,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323205,9 +323909,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323237,9 +323941,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323344,9 +324048,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323376,9 +324080,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323483,9 +324187,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323515,9 +324219,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323622,9 +324326,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323654,9 +324358,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323761,9 +324465,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323793,9 +324497,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -323900,9 +324604,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323932,9 +324636,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324039,9 +324743,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324071,9 +324775,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324178,9 +324882,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324210,9 +324914,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324317,9 +325021,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324349,9 +325053,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324456,9 +325160,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324488,9 +325192,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324595,9 +325299,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324627,9 +325331,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324734,9 +325438,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324766,9 +325470,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -324873,9 +325577,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324905,9 +325609,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325012,9 +325716,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325044,9 +325748,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325151,9 +325855,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325183,9 +325887,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325290,9 +325994,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325322,9 +326026,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325429,9 +326133,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325461,9 +326165,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325568,9 +326272,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325600,9 +326304,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325707,9 +326411,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325739,9 +326443,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325846,9 +326550,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325878,9 +326582,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -325985,9 +326689,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326017,9 +326721,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326124,9 +326828,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326156,9 +326860,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326263,9 +326967,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326295,9 +326999,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326402,9 +327106,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326434,9 +327138,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326541,9 +327245,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326573,9 +327277,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326680,9 +327384,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326712,9 +327416,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326819,9 +327523,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326851,9 +327555,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -326958,9 +327662,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326990,9 +327694,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327097,9 +327801,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327129,9 +327833,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327236,9 +327940,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327268,9 +327972,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327375,9 +328079,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327407,9 +328111,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327514,9 +328218,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327546,9 +328250,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327653,9 +328357,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327685,9 +328389,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327792,9 +328496,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327824,9 +328528,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -327931,9 +328635,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327963,9 +328667,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328070,9 +328774,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328102,9 +328806,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328209,9 +328913,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328241,9 +328945,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328348,9 +329052,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328380,9 +329084,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328487,9 +329191,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328519,9 +329223,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328626,9 +329330,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328658,9 +329362,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328765,9 +329469,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328797,9 +329501,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -328904,9 +329608,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328936,9 +329640,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329043,9 +329747,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329075,9 +329779,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329182,9 +329886,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329214,9 +329918,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329321,9 +330025,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329353,9 +330057,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329460,9 +330164,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329492,9 +330196,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329599,9 +330303,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329631,9 +330335,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329738,9 +330442,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329770,9 +330474,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -329877,9 +330581,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329909,9 +330613,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330016,9 +330720,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330048,9 +330752,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330155,9 +330859,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330187,9 +330891,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330294,9 +330998,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330326,9 +331030,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330433,9 +331137,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330465,9 +331169,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330572,9 +331276,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330604,9 +331308,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330711,9 +331415,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330743,9 +331447,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330850,9 +331554,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330882,9 +331586,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -330989,9 +331693,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331021,9 +331725,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331128,9 +331832,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331160,9 +331864,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331267,9 +331971,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331299,9 +332003,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331406,9 +332110,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331438,9 +332142,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331545,9 +332249,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331577,9 +332281,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331684,9 +332388,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331716,9 +332420,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331823,9 +332527,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331855,9 +332559,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -331962,9 +332666,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331994,9 +332698,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332101,9 +332805,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332133,9 +332837,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332240,9 +332944,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332272,9 +332976,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332379,9 +333083,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332411,9 +333115,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332518,9 +333222,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332550,9 +333254,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332657,9 +333361,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332689,9 +333393,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332796,9 +333500,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332828,9 +333532,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -332935,9 +333639,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332967,9 +333671,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333074,9 +333778,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333106,9 +333810,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333213,9 +333917,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333245,9 +333949,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333352,9 +334056,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333384,9 +334088,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333491,9 +334195,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333523,9 +334227,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333630,9 +334334,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333662,9 +334366,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333769,9 +334473,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333801,9 +334505,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -333908,9 +334612,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333940,9 +334644,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334047,9 +334751,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334079,9 +334783,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334186,9 +334890,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334218,9 +334922,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334325,9 +335029,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334357,9 +335061,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334464,9 +335168,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334496,9 +335200,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334603,9 +335307,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334635,9 +335339,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334742,9 +335446,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334774,9 +335478,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -334881,9 +335585,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334913,9 +335617,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335020,9 +335724,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335052,9 +335756,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335159,9 +335863,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335191,9 +335895,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335298,9 +336002,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335330,9 +336034,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335437,9 +336141,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335469,9 +336173,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335576,9 +336280,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335608,9 +336312,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335715,9 +336419,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335747,9 +336451,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335854,9 +336558,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335886,9 +336590,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -335993,9 +336697,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336025,9 +336729,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336132,9 +336836,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336164,9 +336868,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336271,9 +336975,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336303,9 +337007,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336410,9 +337114,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336442,9 +337146,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336549,9 +337253,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336581,9 +337285,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336688,9 +337392,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336720,9 +337424,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336827,9 +337531,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336859,9 +337563,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -336966,9 +337670,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336998,9 +337702,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337105,9 +337809,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337137,9 +337841,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337244,9 +337948,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337276,9 +337980,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337383,9 +338087,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337415,9 +338119,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337522,9 +338226,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337554,9 +338258,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337661,9 +338365,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337693,9 +338397,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337800,9 +338504,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337832,9 +338536,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -337939,9 +338643,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337971,9 +338675,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338078,9 +338782,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338110,9 +338814,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338217,9 +338921,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338249,9 +338953,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338356,9 +339060,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338388,9 +339092,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338495,9 +339199,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338527,9 +339231,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338634,9 +339338,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338666,9 +339370,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338773,9 +339477,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338805,9 +339509,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -338912,9 +339616,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338944,9 +339648,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339051,9 +339755,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339083,9 +339787,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339190,9 +339894,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339222,9 +339926,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339329,9 +340033,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339361,9 +340065,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339468,9 +340172,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339500,9 +340204,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339607,9 +340311,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339639,9 +340343,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339746,9 +340450,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339778,9 +340482,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -339885,9 +340589,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339917,9 +340621,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340024,9 +340728,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340056,9 +340760,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340163,9 +340867,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340195,9 +340899,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340302,9 +341006,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340334,9 +341038,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340441,9 +341145,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340473,9 +341177,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340580,9 +341284,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340612,9 +341316,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340719,9 +341423,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340751,9 +341455,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340858,9 +341562,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340890,9 +341594,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -340997,9 +341701,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341029,9 +341733,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341136,9 +341840,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341168,9 +341872,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341275,9 +341979,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341307,9 +342011,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341414,9 +342118,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341446,9 +342150,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341553,9 +342257,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341585,9 +342289,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341692,9 +342396,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341724,9 +342428,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341831,9 +342535,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341863,9 +342567,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -341970,9 +342674,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342002,9 +342706,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342109,9 +342813,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342141,9 +342845,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342248,9 +342952,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342280,9 +342984,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342387,9 +343091,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342419,9 +343123,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342526,9 +343230,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342558,9 +343262,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342665,9 +343369,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342697,9 +343401,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342804,9 +343508,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342836,9 +343540,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -342943,9 +343647,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342975,9 +343679,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343082,9 +343786,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343114,9 +343818,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343221,9 +343925,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343253,9 +343957,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343360,9 +344064,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343392,9 +344096,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343499,9 +344203,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343531,9 +344235,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343638,9 +344342,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343670,9 +344374,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343777,9 +344481,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343809,9 +344513,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -343916,9 +344620,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343948,9 +344652,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344055,9 +344759,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344087,9 +344791,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344194,9 +344898,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344226,9 +344930,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344333,9 +345037,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344365,9 +345069,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344472,9 +345176,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344504,9 +345208,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344611,9 +345315,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344643,9 +345347,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344750,9 +345454,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344782,9 +345486,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -344889,9 +345593,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344921,9 +345625,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345028,9 +345732,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345060,9 +345764,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345167,9 +345871,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345199,9 +345903,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345306,9 +346010,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345338,9 +346042,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345445,9 +346149,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345477,9 +346181,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345584,9 +346288,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345616,9 +346320,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345723,9 +346427,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345755,9 +346459,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -345862,9 +346566,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345894,9 +346598,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346001,9 +346705,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346033,9 +346737,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346140,9 +346844,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346172,9 +346876,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346279,9 +346983,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346311,9 +347015,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346418,9 +347122,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346450,9 +347154,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346557,9 +347261,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346589,9 +347293,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346696,9 +347400,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346728,9 +347432,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346835,9 +347539,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346867,9 +347571,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -346974,9 +347678,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347006,9 +347710,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347113,9 +347817,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347145,9 +347849,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347252,9 +347956,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347284,9 +347988,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347391,9 +348095,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347423,9 +348127,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347530,9 +348234,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347562,9 +348266,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347669,9 +348373,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347701,9 +348405,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347808,9 +348512,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347840,9 +348544,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -347947,9 +348651,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347979,9 +348683,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", @@ -348086,9 +348790,9 @@ }, { "techniqueID": "T1036.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348118,9 +348822,9 @@ }, { "techniqueID": "T1003.003", - "score": -1, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { "techniqueID": "T1124", diff --git a/docs/splunk_docs_categories.wiki b/docs/splunk_docs_categories.wiki index 5a5db4d4f8..8ff93c42df 100644 --- a/docs/splunk_docs_categories.wiki +++ b/docs/splunk_docs_categories.wiki @@ -346,6 +346,57 @@ version = 1 +===Cobalt Strike=== + +Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. + +
+
+ +====Narrative==== +This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\ +In generating content for Cobalt Strike, the following is considered:\ +1. Is it normal for to have no command line arguments? No command line arguments and a network connection?\ +1. What is the default, or normal, process lineage for ?\ +1. Does the make network connections?\ +1. Is it normal for to load jscript, vbscript, Amsi.dll, and clr.dll?. + +====Detections==== +* Suspicious Rundll32 StartW +* Suspicious Rundll32 no CommandLine Arguments + +====Data Models==== +* Endpoint + +====Tags==== + +=====ATT&CK===== +* T1218.011 + +=====Kill Chain Phases===== +* Actions on Objectives + +=====CIS===== +* CIS 8 + +=====NIST===== +* DE.CM +* PR.PT + +====References==== +* https://www.cobaltstrike.com/ +* https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/ +* https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/ +* https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html +* https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html + +date = 2021-02-16 + +version = 1 + +
+
+ ===Collection and Staging=== Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. @@ -542,12 +593,16 @@ The detection searches in this Analytic Story monitor access to the Local Securi * Create Remote Thread into LSASS * Creation of Shadow Copy * Creation of Shadow Copy with wmic and powershell +* Creation of lsass Dump with Taskmgr * Credential Dumping via Copy Command from Shadow Copy * Credential Dumping via Symlink to Shadow Copy * Detect Credential Dumping through LSASS access * Detect Dump LSASS Memory using comsvcs - SSA * Detect Mimikatz Using Loaded Images * Dump LSASS via comsvcs DLL +* Dump LSASS via procdump +* Dump LSASS via procdump Rename +* Ntdsutil export ntds * Unsigned Image Loaded by LSASS ====Data Models==== @@ -1293,6 +1348,55 @@ version = 2 +===Suspicious Compiled HTML Activity=== + +Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. + +
+
+ +====Narrative==== +Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + +====Detections==== +* Detect HTML Help Renamed +* Detect HTML Help Spawn Child Process +* Detect HTML Help URL in Command Line +* Detect HTML Help Using InfoTech Storage Handlers + +====Data Models==== +* Endpoint + +====Tags==== + +=====ATT&CK===== +* T1218.001 + +=====Kill Chain Phases===== +* Actions on Objectives + +=====CIS===== +* CIS 8 + +=====NIST===== +* DE.CM +* PR.PT + +====References==== +* https://redcanary.com/blog/introducing-atomictestharnesses/ +* https://attack.mitre.org/techniques/T1218/001/ +* https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa + +date = 2021-02-11 + +version = 1 + +
+
+ ===Suspicious DNS Traffic=== Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. @@ -1415,9 +1519,15 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
====Narrative==== -One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ -The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 2. Determine if script code was executed with MSHTA. \ Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ +Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\ +1. Determine if script code was executed with MSHTA.\ +Situational Awareness\ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ The objective of this step is to confirm the executed script code is benign or malicious. ====Detections==== * Detect MSHTA Url in Command Line @@ -1477,7 +1587,7 @@ While SSO is a major convenience for users, it also provides attackers with an o With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. ====Detections==== -* Multiple Okta Users With Invalid Credentails From The Same IP +* Multiple Okta Users With Invalid Credentials From The Same IP * Okta Account Lockout Events * Okta Failed SSO Attempts * Okta User Logins From Multiple Cities @@ -1509,6 +1619,153 @@ version = 1
+===Suspicious Regsvcs Regasm Activity=== + +Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. + +
+
+ +====Narrative==== + Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + +====Detections==== +* Detect Regasm Spawning a Process +* Detect Regasm with Network Connection +* Detect Regasm with no Command Line Arguments +* Detect Regsvcs Spawning a Process +* Detect Regsvcs with Network Connection +* Detect Regsvcs with No Command Line Arguments + +====Data Models==== +* Endpoint + +====Tags==== + +=====ATT&CK===== +* T1218.009 + +=====Kill Chain Phases===== +* Actions on Objectives + +=====CIS===== +* CIS 8 + +=====NIST===== +* DE.CM +* PR.PT + +====References==== +* https://attack.mitre.org/techniques/T1218/009/ +* https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md +* https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/ + +date = 2021-02-11 + +version = 1 + +
+
+ +===Suspicious Regsvr32 Activity=== + +Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. + +
+
+ +====Narrative==== +One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious. + +====Detections==== +* Detect Regsvr32 Application Control Bypass +* Suspicious Regsvr32 Register Suspicious Path + +====Data Models==== +* Endpoint + +====Tags==== + +=====ATT&CK===== +* T1218.010 + +=====Kill Chain Phases===== +* Actions on Objectives + +=====CIS===== +* CIS 16 +* CIS 8 + +=====NIST===== +* DE.CM + +====References==== +* https://attack.mitre.org/techniques/T1218/010/ +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md +* https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ + +date = 2021-01-29 + +version = 1 + +
+
+ +===Suspicious Rundll32 Activity=== + +Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. + +
+
+ +====Narrative==== +One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. + +====Detections==== +* Detect Rundll32 Application Control Bypass - advpack +* Detect Rundll32 Application Control Bypass - setupapi +* Detect Rundll32 Application Control Bypass - syssetup +* Dump LSASS via comsvcs DLL +* Suspicious Rundll32 Rename +* Suspicious Rundll32 StartW +* Suspicious Rundll32 dllregisterserver +* Suspicious Rundll32 no CommandLine Arguments + +====Data Models==== +* Endpoint + +====Tags==== + +=====ATT&CK===== +* T1003.001 +* T1036.003 +* T1218.011 + +=====Kill Chain Phases===== +* Actions on Objectives + +=====CIS===== +* CIS 16 +* CIS 3 +* CIS 5 +* CIS 8 + +=====NIST===== +* DE.CM +* PR.PT + +====References==== +* https://attack.mitre.org/techniques/T1218/011/ +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +* https://lolbas-project.github.io/lolbas/Binaries/Rundll32 + +date = 2021-02-03 + +version = 1 + +
+
+ ===Suspicious Windows Registry Activities=== Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. @@ -1727,10 +1984,20 @@ Monitor and detect techniques used by attackers who leverage the msbuild.exe pro
====Narrative==== -Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. \ -The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution. \ -The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata. 2. Determine if script code was executed with MSBuild. Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ +The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\ +Triage\ +Validate execution\ +1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata.\ +1. Determine if script code was executed with MSBuild.\ +Situational Awareness\ +The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ +The objective of this step is to confirm the executed script code is benign or malicious. ====Detections==== * Suspicious MSBuild Rename @@ -1932,6 +2199,7 @@ Monitor for activities and techniques associated with maintaining persistence on Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. ====Detections==== +* Certutil exe certificate extraction * Detect Path Interception By Creation Of program exe * Hiding Files And Directories With Attrib exe * Monitor Registry Keys for Print Monitors @@ -2705,6 +2973,78 @@ version = 1
+===Cloud Federated Credential Abuse=== + +This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. + +
+
+ +====Narrative==== +This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. + +====Detections==== +* AWS SAML Access by Provider User and Principal +* AWS SAML Update identity provider +* Certutil exe certificate extraction +* Detect Mimikatz Using Loaded Images +* Detect Mimikatz Via PowerShell And EventCode 4703 +* Detect Rare Executables +* O365 Add App Role Assignment Grant User +* O365 Added Service Principal +* O365 Excessive SSO logon errors +* O365 New Federated Domain Added +* Registry Keys Used For Privilege Escalation +* Uncommon Processes On Endpoint + +====Data Models==== +* Endpoint + +====Tags==== + +=====ATT&CK===== +* T1003.001 +* T1078 +* T1136.003 +* T1204.002 +* T1546.012 +* T1556 + +=====Kill Chain Phases===== +* Actions on Objective +* Actions on Objectives +* Command and Control +* Installation + +=====CIS===== +* CIS 16 +* CIS 2 +* CIS 3 +* CIS 5 +* CIS 6 +* CIS 8 + +=====NIST===== +* DE.AE +* DE.CM +* ID.AM +* PR.AC +* PR.DS +* PR.IP +* PR.PT + +====References==== +* https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +* https://us-cert.cisa.gov/ncas/alerts/aa21-008a + +date = 2021-01-26 + +version = 1 + +
+
+ ===Container Implantation Monitoring and Investigation=== Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. @@ -2926,9 +3266,13 @@ More and more companies are using Microsofts Office 365 cloud offering. Therefor ====Detections==== * High Number of Login Failures from a single source +* O365 Add App Role Assignment Grant User +* O365 Added Service Principal * O365 Bypass MFA via Trusted IP * O365 Disable MFA * O365 Excessive Authentication Failures Alert +* O365 Excessive SSO logon errors +* O365 New Federated Domain Added * O365 PST export alert * O365 Suspicious Admin Email Forwarding * O365 Suspicious Rights Delegation @@ -2944,6 +3288,7 @@ More and more companies are using Microsofts Office 365 cloud offering. Therefor * T1114 * T1114.002 * T1114.003 +* T1136.003 * T1556 * T1562.007 @@ -3376,7 +3721,7 @@ Similar to other cloud providers, GCP operates on a shared responsibility model. * PR.DS ====References==== -* https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security +* https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security * https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/ date = 2020-08-05 diff --git a/docs/stories_categories.md b/docs/stories_categories.md index 31135a5062..fc6be2613f 100644 --- a/docs/stories_categories.md +++ b/docs/stories_categories.md @@ -294,6 +294,8 @@ Another search detects incidents wherein a single password is used across multip * [Baron Samedit CVE-2021-3156](#Baron-Samedit-CVE-2021-3156) +* [Cobalt Strike](#Cobalt-Strike) + * [Collection and Staging](#Collection-and-Staging) * [Command and Control](#Command-and-Control) @@ -326,6 +328,8 @@ Another search detects incidents wherein a single password is used across multip * [Suspicious Command-Line Executions](#Suspicious-Command-Line-Executions) +* [Suspicious Compiled HTML Activity](#Suspicious-Compiled-HTML-Activity) + * [Suspicious DNS Traffic](#Suspicious-DNS-Traffic) * [Suspicious Emails](#Suspicious-Emails) @@ -334,6 +338,12 @@ Another search detects incidents wherein a single password is used across multip * [Suspicious Okta Activity](#Suspicious-Okta-Activity) +* [Suspicious Regsvcs Regasm Activity](#Suspicious-Regsvcs-Regasm-Activity) + +* [Suspicious Regsvr32 Activity](#Suspicious-Regsvr32-Activity) + +* [Suspicious Rundll32 Activity](#Suspicious-Rundll32-Activity) + * [Suspicious Windows Registry Activities](#Suspicious-Windows-Registry-Activities) * [Suspicious WMI Use](#Suspicious-WMI-Use) @@ -391,6 +401,51 @@ A non-privledged user is able to execute the sudoedit command to trigger a buffe ##### References * https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit +### Cobalt Strike +* id = bcfd17e8-5461-400a-80a2-3b7d1459220c +* date = 2021-02-16 +* version = 1 + +#### Description +Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. + +#### Narrative +This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\ +In generating content for Cobalt Strike, the following is considered:\ +1. Is it normal for to have no command line arguments? No command line arguments and a network connection?\ +1. What is the default, or normal, process lineage for ?\ +1. Does the make network connections?\ +1. Is it normal for to load jscript, vbscript, Amsi.dll, and clr.dll?. + +#### Detections +* Suspicious Rundll32 StartW +* Suspicious Rundll32 no CommandLine Arguments + +#### Data Models +* Endpoint + +#### Mappings + +##### ATT&CK +* T1218.011 + +##### Kill Chain Phases +* Actions on Objectives + +###### CIS +* CIS 8 + +##### NIST +* DE.CM +* PR.PT + +##### References +* https://www.cobaltstrike.com/ +* https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/ +* https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/ +* https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html +* https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html + ### Collection and Staging * id = 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a * date = 2020-02-03 @@ -570,12 +625,16 @@ The detection searches in this Analytic Story monitor access to the Local Securi * Create Remote Thread into LSASS * Creation of Shadow Copy * Creation of Shadow Copy with wmic and powershell +* Creation of lsass Dump with Taskmgr * Credential Dumping via Copy Command from Shadow Copy * Credential Dumping via Symlink to Shadow Copy * Detect Credential Dumping through LSASS access * Detect Dump LSASS Memory using comsvcs - SSA * Detect Mimikatz Using Loaded Images * Dump LSASS via comsvcs DLL +* Dump LSASS via procdump +* Dump LSASS via procdump Rename +* Ntdsutil export ntds * Unsigned Image Loaded by LSASS #### Data Models @@ -1242,6 +1301,49 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal * https://www.microsoft.com/en-us/wdsi/threats/macro-malware * https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf +### Suspicious Compiled HTML Activity +* id = a09db4d1-3827-4833-87b8-3a397e532119 +* date = 2021-02-11 +* version = 1 + +#### Description +Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. + +#### Narrative +Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + +#### Detections +* Detect HTML Help Renamed +* Detect HTML Help Spawn Child Process +* Detect HTML Help URL in Command Line +* Detect HTML Help Using InfoTech Storage Handlers + +#### Data Models +* Endpoint + +#### Mappings + +##### ATT&CK +* T1218.001 + +##### Kill Chain Phases +* Actions on Objectives + +###### CIS +* CIS 8 + +##### NIST +* DE.CM +* PR.PT + +##### References +* https://redcanary.com/blog/introducing-atomictestharnesses/ +* https://attack.mitre.org/techniques/T1218/001/ +* https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa + ### Suspicious DNS Traffic * id = 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56 * date = 2017-09-18 @@ -1353,9 +1455,15 @@ Once a phishing message has been detected, the next steps are to answer the foll Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. #### Narrative -One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ -The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 2. Determine if script code was executed with MSHTA. \ Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ +Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\ +1. Determine if script code was executed with MSHTA.\ +Situational Awareness\ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ The objective of this step is to confirm the executed script code is benign or malicious. #### Detections * Detect MSHTA Url in Command Line @@ -1409,7 +1517,7 @@ While SSO is a major convenience for users, it also provides attackers with an o With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. #### Detections -* Multiple Okta Users With Invalid Credentails From The Same IP +* Multiple Okta Users With Invalid Credentials From The Same IP * Okta Account Lockout Events * Okta Failed SSO Attempts * Okta User Logins From Multiple Cities @@ -1434,6 +1542,135 @@ With people moving quickly to adopt web-based applications and ways to manage th * https://owasp.org/www-community/attacks/Credential_stuffing * https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work +### Suspicious Regsvcs Regasm Activity +* id = 2cdf33a0-4805-4b61-b025-59c20f418fbe +* date = 2021-02-11 +* version = 1 + +#### Description +Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. + +#### Narrative + Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + +#### Detections +* Detect Regasm Spawning a Process +* Detect Regasm with Network Connection +* Detect Regasm with no Command Line Arguments +* Detect Regsvcs Spawning a Process +* Detect Regsvcs with Network Connection +* Detect Regsvcs with No Command Line Arguments + +#### Data Models +* Endpoint + +#### Mappings + +##### ATT&CK +* T1218.009 + +##### Kill Chain Phases +* Actions on Objectives + +###### CIS +* CIS 8 + +##### NIST +* DE.CM +* PR.PT + +##### References +* https://attack.mitre.org/techniques/T1218/009/ +* https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md +* https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/ + +### Suspicious Regsvr32 Activity +* id = b8bee41e-624f-11eb-ae93-0242ac130002 +* date = 2021-01-29 +* version = 1 + +#### Description +Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. + +#### Narrative +One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious. + +#### Detections +* Detect Regsvr32 Application Control Bypass +* Suspicious Regsvr32 Register Suspicious Path + +#### Data Models +* Endpoint + +#### Mappings + +##### ATT&CK +* T1218.010 + +##### Kill Chain Phases +* Actions on Objectives + +###### CIS +* CIS 16 +* CIS 8 + +##### NIST +* DE.CM + +##### References +* https://attack.mitre.org/techniques/T1218/010/ +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md +* https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ + +### Suspicious Rundll32 Activity +* id = 80a65487-854b-42f1-80a1-935e4c170694 +* date = 2021-02-03 +* version = 1 + +#### Description +Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. + +#### Narrative +One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. + +#### Detections +* Detect Rundll32 Application Control Bypass - advpack +* Detect Rundll32 Application Control Bypass - setupapi +* Detect Rundll32 Application Control Bypass - syssetup +* Dump LSASS via comsvcs DLL +* Suspicious Rundll32 Rename +* Suspicious Rundll32 StartW +* Suspicious Rundll32 dllregisterserver +* Suspicious Rundll32 no CommandLine Arguments + +#### Data Models +* Endpoint + +#### Mappings + +##### ATT&CK +* T1003.001 +* T1036.003 +* T1218.011 + +##### Kill Chain Phases +* Actions on Objectives + +###### CIS +* CIS 16 +* CIS 3 +* CIS 5 +* CIS 8 + +##### NIST +* DE.CM +* PR.PT + +##### References +* https://attack.mitre.org/techniques/T1218/011/ +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md +* https://lolbas-project.github.io/lolbas/Binaries/Rundll32 + ### Suspicious Windows Registry Activities * id = 2b1800dd-92f9-47dd-a981-fdf1351e5d55 * date = 2018-05-31 @@ -1629,10 +1866,20 @@ The searches in this story help you detect and investigate suspicious activity t Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. #### Narrative -Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. \ -The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution. \ -The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata. 2. Determine if script code was executed with MSBuild. Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ +The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\ +Triage\ +Validate execution\ +1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata.\ +1. Determine if script code was executed with MSBuild.\ +Situational Awareness\ +The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ +The objective of this step is to confirm the executed script code is benign or malicious. #### Detections * Suspicious MSBuild Rename @@ -1810,6 +2057,7 @@ Monitor for activities and techniques associated with maintaining persistence on Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. #### Detections +* Certutil exe certificate extraction * Detect Path Interception By Creation Of program exe * Hiding Files And Directories With Attrib exe * Monitor Registry Keys for Print Monitors @@ -2228,6 +2476,8 @@ Various legacy protocols operate by default in the clear, without the protection * [Cloud Cryptomining](#Cloud-Cryptomining) +* [Cloud Federated Credential Abuse](#Cloud-Federated-Credential-Abuse) + * [Container Implantation Monitoring and Investigation](#Container-Implantation-Monitoring-and-Investigation) * [GCP Cross Account Activity](#GCP-Cross-Account-Activity) @@ -2546,6 +2796,72 @@ This Analytic Story is focused on detecting suspicious new instances in your clo ##### References * https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf +### Cloud Federated Credential Abuse +* id = cecdc1e7-0af2-4a55-8967-b9ea62c0317d +* date = 2021-01-26 +* version = 1 + +#### Description +This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. + +#### Narrative +This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. + +#### Detections +* AWS SAML Access by Provider User and Principal +* AWS SAML Update identity provider +* Certutil exe certificate extraction +* Detect Mimikatz Using Loaded Images +* Detect Mimikatz Via PowerShell And EventCode 4703 +* Detect Rare Executables +* O365 Add App Role Assignment Grant User +* O365 Added Service Principal +* O365 Excessive SSO logon errors +* O365 New Federated Domain Added +* Registry Keys Used For Privilege Escalation +* Uncommon Processes On Endpoint + +#### Data Models +* Endpoint + +#### Mappings + +##### ATT&CK +* T1003.001 +* T1078 +* T1136.003 +* T1204.002 +* T1546.012 +* T1556 + +##### Kill Chain Phases +* Actions on Objective +* Actions on Objectives +* Command and Control +* Installation + +###### CIS +* CIS 16 +* CIS 2 +* CIS 3 +* CIS 5 +* CIS 6 +* CIS 8 + +##### NIST +* DE.AE +* DE.CM +* ID.AM +* PR.AC +* PR.DS +* PR.IP +* PR.PT + +##### References +* https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +* https://us-cert.cisa.gov/ncas/alerts/aa21-008a + ### Container Implantation Monitoring and Investigation * id = aa0e28b1-0521-4b6f-9d2a-7b87e34af246 * date = 2020-02-20 @@ -2738,9 +3054,13 @@ More and more companies are using Microsofts Office 365 cloud offering. Therefor #### Detections * High Number of Login Failures from a single source +* O365 Add App Role Assignment Grant User +* O365 Added Service Principal * O365 Bypass MFA via Trusted IP * O365 Disable MFA * O365 Excessive Authentication Failures Alert +* O365 Excessive SSO logon errors +* O365 New Federated Domain Added * O365 PST export alert * O365 Suspicious Admin Email Forwarding * O365 Suspicious Rights Delegation @@ -2756,6 +3076,7 @@ More and more companies are using Microsofts Office 365 cloud offering. Therefor * T1114 * T1114.002 * T1114.003 +* T1136.003 * T1556 * T1562.007 @@ -3134,7 +3455,7 @@ Similar to other cloud providers, GCP operates on a shared responsibility model. * PR.DS ##### References -* https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security +* https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security * https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/ ### Unusual AWS EC2 Modifications diff --git a/package/app.manifest b/package/app.manifest index 0190b0f6f5..19beea9faa 100644 --- a/package/app.manifest +++ b/package/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.14.0" + "version": "3.15.0" }, "author": [ { diff --git a/package/default/analytic_stories.conf b/package/default/analytic_stories.conf index 4179f936df..426195be74 100644 --- a/package/default/analytic_stories.conf +++ b/package/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:19 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -16,8 +16,8 @@ version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] detection_searches = ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078", "T1550"]} -investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["batch - Previously Seen AWS Cross Account Activity"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task"] +support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"] data_models = [] providing_technologies = none description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. @@ -34,8 +34,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] -support_searches = ["batch - Baseline of Excessive AWS Instances Launched by User - MLTK", "batch - Previously Seen EC2 Instance Types", "batch - Previously Seen EC2 Launches By User", "batch - Previously Seen EC2 AMIs", "batch - Previously Seen AWS Regions"] +investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +support_searches = ["ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK"] data_models = [] providing_technologies = none description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -53,8 +53,8 @@ version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["batch - Baseline of Network ACL Activity by ARN", "batch - Baseline of blocked outbound traffic from AWS"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN"] data_models = [] providing_technologies = none description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. @@ -69,7 +69,7 @@ version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule"] mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]} -investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -85,8 +85,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} -investigative_searches = ["ESCU - Get All AWS Activity From Country - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] -support_searches = ["batch - Previously Seen AWS Provisioning Activity Sources"] +investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"] +support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"] data_models = [] providing_technologies = none description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. @@ -103,7 +103,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] -support_searches = ["batch - Previously seen API call per user roles in CloudTrail", "batch - Baseline of Security Group Activity by ARN", "batch - Create a list of approved AWS service accounts", "batch - Baseline of API Calls per User ARN"] +support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN"] data_models = [] providing_technologies = none description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. @@ -121,7 +121,7 @@ version = 1 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] +investigative_searches = ["ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -151,7 +151,7 @@ reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-un detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"] mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Reconnaissance"], "nist": ["ID.AM", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task"] -support_searches = ["batch - Count of assets by category"] +support_searches = ["ESCU - Count of assets by category"] data_models = ["Network_Sessions"] providing_technologies = none description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. @@ -182,8 +182,8 @@ version = 1 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] -support_searches = ["batch - DNSTwist Domain Names"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "Network_Resolution", "Web"] providing_technologies = none description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. @@ -200,8 +200,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] -support_searches = ["batch - Baseline Of Cloud Instances Launched", "batch - Previously Seen Cloud Compute Images - Update", "batch - Previously Seen Cloud Compute Images - Initial", "batch - Previously Seen Cloud Compute Instance Types - Update", "batch - Previously Seen Cloud Regions - Initial", "batch - Baseline Of Cloud Instances Destroyed", "batch - Previously Seen Cloud Compute Creations By User - Initial", "batch - Previously Seen Cloud Regions - Update", "batch - Previously Seen Cloud Compute Instance Types - Initial", "batch - Previously Seen Cloud Compute Creations By User - Update"] +investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +support_searches = ["ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Images - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -210,6 +210,43 @@ Cryptojacking has attracted an increasing amount of media attention since its ex When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \ This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches. +[Cloud Federated Credential Abuse] +category = Cloud Security +creation_date = 2021-01-26 +modification_date = 2021-01-26 +id = cecdc1e7-0af2-4a55-8967-b9ea62c0317d +version = 1 +reference = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] +detection_searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1003.001", "T1078", "T1136.003", "T1204.002", "T1546.012", "T1556"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. +narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. + +[Cobalt Strike] +category = Adversary Tactics +creation_date = 2021-02-16 +modification_date = 2021-02-16 +id = bcfd17e8-5461-400a-80a2-3b7d1459220c +version = 1 +reference = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html"] +detection_searches = ["ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\ +In generating content for Cobalt Strike, the following is considered:\ +1. Is it normal for to have no command line arguments? No command line arguments and a network connection?\ +1. What is the default, or normal, process lineage for ?\ +1. Does the make network connections?\ +1. Is it normal for to load jscript, vbscript, Amsi.dll, and clr.dll?. + [ColdRoot MacOS RAT] category = Malware creation_date = 2019-01-09 @@ -255,8 +292,8 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["batch - Baseline of blocked outbound traffic from AWS", "batch - Baseline of DNS Query Length - MLTK"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of DNS Query Length - MLTK"] data_models = ["Network_Resolution", "Network_Traffic"] providing_technologies = none description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. @@ -303,9 +340,9 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Ntdsutil export ntds - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} -investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task"] +investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -323,8 +360,8 @@ version = 2 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["batch - Baseline of SMB Traffic - MLTK", "batch - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. @@ -360,7 +397,7 @@ reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insight detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] -support_searches = ["batch - Discover DNS records"] +support_searches = ["ESCU - Discover DNS records"] data_models = ["Network_Resolution"] providing_technologies = none description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. @@ -399,7 +436,7 @@ version = 1 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Change_Analysis", "Network_Resolution"] providing_technologies = none @@ -432,7 +469,7 @@ reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malw detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["batch - Baseline of SMB Traffic - MLTK", "batch - Previously seen command line arguments"] +support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. @@ -447,7 +484,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] support_searches = [] data_models = ["Network_Resolution", "Web"] providing_technologies = none @@ -463,8 +500,8 @@ version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["batch - Baseline of SMB Traffic - MLTK"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Email", "Endpoint", "Network_Traffic"] providing_technologies = none description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. @@ -515,8 +552,8 @@ version = 2 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task"] -support_searches = ["batch - Baseline of DNS Query Length - MLTK", "batch - Baseline of SMB Traffic - MLTK", "batch - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments", "ESCU - Baseline of DNS Query Length - MLTK"] data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. @@ -628,7 +665,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1053.005", "T1550.002", "T1558.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none @@ -648,7 +685,7 @@ version = 4 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] detection_searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -674,7 +711,7 @@ reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-u detection_searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"] mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - All backup logs for host - Response Task"] -support_searches = ["batch - Monitor Unsuccessful Backups", "batch - Monitor Successful Backups"] +support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"] data_models = [] providing_technologies = none description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. @@ -725,7 +762,7 @@ reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb49 detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["batch - Baseline of SMB Traffic - MLTK", "batch - Previously seen command line arguments"] +support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. @@ -739,8 +776,8 @@ modification_date = 2020-12-16 id = 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9 version = 1 reference = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] -detection_searches = ["ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] -mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Not Applicable"], "mitre_attack": ["T1110", "T1110.001", "T1114", "T1114.002", "T1114.003", "T1556", "T1562.007"], "nist": ["DE.AE", "DE.DP"]} +detection_searches = ["ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] +mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Not Applicable"], "mitre_attack": ["T1110", "T1110.001", "T1114", "T1114.002", "T1114.003", "T1136.003", "T1556", "T1562.007"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = [] support_searches = [] data_models = [] @@ -757,8 +794,8 @@ version = 2 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] -support_searches = ["batch - Previously Seen Running Windows Services - Update", "batch - Previously Seen Running Windows Services - Initial", "batch - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously Seen Running Windows Services - Initial"] data_models = ["Endpoint"] providing_technologies = none description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. @@ -799,8 +836,8 @@ version = 1 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] -support_searches = ["batch - Baseline of Command Line Length - MLTK", "batch - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. @@ -842,7 +879,7 @@ version = 1 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] data_models = ["Network_Resolution", "Network_Traffic"] providing_technologies = none @@ -858,8 +895,8 @@ version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["batch - Baseline of SMB Traffic - MLTK", "batch - Baseline of Command Line Length - MLTK"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. @@ -940,7 +977,7 @@ version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic", "Web"] providing_technologies = none @@ -962,7 +999,7 @@ reference = ["https://meltdownattack.com/"] detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"] mappings = {"cis20": ["CIS 4"], "nist": ["DE.CM", "ID.RA", "PR.IP", "RS.MI"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] -support_searches = ["batch - Systems Ready for Spectre-Meltdown Windows Patch"] +support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"] data_models = ["Vulnerabilities"] providing_technologies = none description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story. @@ -1022,7 +1059,7 @@ reference = ["https://www.fireeye.com/blog/threat-research/2020/12/evasive-attac detection_searches = ["ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows AdFind Exe - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 5", "CIS 6", "CIS 7", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exfiltration", "Exploitation", "Installation"], "mitre_attack": ["T1018", "T1027", "T1053.005", "T1059.003", "T1071.001", "T1071.002", "T1203", "T1505.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = [] -support_searches = ["batch - Previously Seen Running Windows Services - Update", "batch - Previously Seen Running Windows Services - Initial"] +support_searches = ["ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously Seen Running Windows Services - Initial"] data_models = ["Endpoint", "Network_Traffic", "Web"] providing_technologies = none description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. @@ -1037,8 +1074,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] -support_searches = ["batch - Previously Seen EC2 Launches By User", "batch - Baseline of Excessive AWS Instances Terminated by User - MLTK", "batch - Baseline of Excessive AWS Instances Launched by User - MLTK", "batch - Previously Seen AWS Regions"] +investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +support_searches = ["ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions"] data_models = [] providing_technologies = none description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. @@ -1054,7 +1091,7 @@ reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integr detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["batch - Update previously seen users in CloudTrail", "batch - Previously seen users in CloudTrail"] +support_searches = ["ESCU - Update previously seen users in CloudTrail", "ESCU - Previously seen users in CloudTrail"] data_models = ["Authentication"] providing_technologies = none description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. @@ -1069,8 +1106,8 @@ version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] -support_searches = ["batch - Previously seen S3 bucket access by remote IP", "batch - Baseline of S3 Bucket deletion activity by ARN"] +investigative_searches = ["ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"] data_models = [] providing_technologies = none description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. @@ -1087,8 +1124,8 @@ version = 1 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["batch - Baseline of blocked outbound traffic from AWS"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] providing_technologies = none description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). @@ -1107,7 +1144,7 @@ reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cr detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] -support_searches = ["batch - Previously Seen Users In CloudTrail - Update", "batch - Previously Seen AWS Cross Account Activity - Update", "batch - Previously Seen Users in CloudTrail - Initial", "batch - Previously Seen AWS Cross Account Activity - Initial"] +support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"] data_models = ["Authentication"] providing_technologies = none description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. @@ -1124,7 +1161,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["batch - Previously Seen Cloud Instance Modifications By User - Initial", "batch - Baseline Of Cloud Instances Launched", "batch - Baseline Of Cloud Instances Destroyed", "batch - Previously Seen Cloud Instance Modifications By User - Update"] +support_searches = ["ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -1140,7 +1177,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] -support_searches = ["batch - Previously Seen Cloud Provisioning Activity Sources - Initial", "batch - Previously Seen Cloud Provisioning Activity Sources - Update"] +support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Update", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -1157,7 +1194,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["batch - Baseline Of Cloud Infrastructure API Calls Per User", "batch - Previously Seen Cloud API Calls Per User Role - Initial", "batch - Previously Seen Cloud API Calls Per User Role - Update", "batch - Baseline Of Cloud Security Group API Calls Per User"] +support_searches = ["ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Baseline Of Cloud Infrastructure API Calls Per User"] data_models = ["Change"] providing_technologies = none description = Detect and investigate suspicious activities by users and roles in your cloud environments. @@ -1174,12 +1211,31 @@ reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.micro detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["batch - Baseline of Command Line Length - MLTK", "batch - Previously seen command line arguments"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. +[Suspicious Compiled HTML Activity] +category = Adversary Tactics +creation_date = 2021-02-11 +modification_date = 2021-02-11 +id = a09db4d1-3827-4833-87b8-3a397e532119 +version = 1 +reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] +detection_searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + [Suspicious DNS Traffic] category = Adversary Tactics creation_date = 2017-09-18 @@ -1189,8 +1245,8 @@ version = 1 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] -support_searches = ["batch - Baseline of DNS Query Length - MLTK"] +investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"] data_models = ["Network_Resolution"] providing_technologies = none description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. @@ -1205,8 +1261,8 @@ version = 1 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] -support_searches = ["batch - DNSTwist Domain Names"] +investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "UEBA"] providing_technologies = none description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. @@ -1222,7 +1278,7 @@ creation_date = 2020-08-05 modification_date = 2020-08-05 id = 4d656b2e-d6be-11ea-87d0-0242ac130003 version = 1 -reference = ["https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] +reference = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] @@ -1242,13 +1298,19 @@ reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "htt detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["batch - Baseline of Command Line Length - MLTK", "batch - Previously seen command line arguments"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ -The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 2. Determine if script code was executed with MSHTA. \ Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ +Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\ +1. Determine if script code was executed with MSHTA.\ +Situational Awareness\ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ The objective of this step is to confirm the executed script code is benign or malicious. [Suspicious Okta Activity] category = Adversary Tactics @@ -1257,9 +1319,9 @@ modification_date = 2020-04-02 id = 9cbd34af-8f39-4476-a423-bacd126c750b version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] -detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] +detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -investigative_searches = ["ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +investigative_searches = ["ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1268,6 +1330,54 @@ narrative = Okta is the leading single sign on (SSO) provider, allowing users to While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. +[Suspicious Regsvcs Regasm Activity] +category = Adversary Tactics +creation_date = 2021-02-11 +modification_date = 2021-02-11 +id = 2cdf33a0-4805-4b61-b025-59c20f418fbe +version = 1 +reference = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] +detection_searches = ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + +[Suspicious Regsvr32 Activity] +category = Adversary Tactics +creation_date = 2021-01-29 +modification_date = 2021-01-29 +id = b8bee41e-624f-11eb-ae93-0242ac130002 +version = 1 +reference = ["https://attack.mitre.org/techniques/T1218/010/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md", "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"] +detection_searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. +narrative = One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious. + +[Suspicious Rundll32 Activity] +category = Adversary Tactics +creation_date = 2021-02-03 +modification_date = 2021-02-03 +id = 80a65487-854b-42f1-80a1-935e4c170694 +version = 1 +reference = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] +detection_searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1036.003", "T1218.011"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. +narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. + [Suspicious WMI Use] category = Adversary Tactics creation_date = 2018-10-23 @@ -1277,7 +1387,7 @@ version = 2 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1314,7 +1424,7 @@ reference = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-y detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1068"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Process File Activity - Response Task"] -support_searches = ["batch - Previously Seen Zoom Child Processes - Update", "batch - Previously Seen Zoom Child Processes - Initial"] +support_searches = ["ESCU - Previously Seen Zoom Child Processes - Initial", "ESCU - Previously Seen Zoom Child Processes - Update"] data_models = ["Endpoint"] providing_technologies = none description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. @@ -1352,10 +1462,20 @@ support_searches = [] data_models = ["Endpoint"] providing_technologies = none description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. -narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. \ -The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution. \ -The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata. 2. Determine if script code was executed with MSBuild. Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ +The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\ +Triage\ +Validate execution\ +1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata.\ +1. Determine if script code was executed with MSBuild.\ +Situational Awareness\ +The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ +The objective of this step is to confirm the executed script code is benign or malicious. [Unusual AWS EC2 Modifications] category = Cloud Security @@ -1366,8 +1486,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["batch - Previously Seen EC2 Modifications By User"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Previously Seen EC2 Modifications By User"] data_models = [] providing_technologies = none description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. @@ -1384,7 +1504,7 @@ reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-wi detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1016", "T1036.003", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["batch - Baseline of Command Line Length - MLTK"] +support_searches = ["ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. @@ -1417,7 +1537,7 @@ version = 1 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"] mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1505,7 +1625,7 @@ modification_date = 2018-05-31 id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version = 2 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] -detection_searches = ["ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule"] +detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1540,7 +1660,7 @@ reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mi detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["batch - Previously Seen Running Windows Services - Update", "batch - Previously Seen Running Windows Services - Initial"] +support_searches = ["ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously Seen Running Windows Services - Initial"] data_models = ["Endpoint"] providing_technologies = none description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. diff --git a/package/default/analyticstories.conf b/package/default/analyticstories.conf index f3fabc621c..500caeaccf 100644 --- a/package/default/analyticstories.conf +++ b/package/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:19 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - aws detect role creation - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -27,7 +27,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -41,7 +41,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -52,7 +52,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -63,7 +63,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -75,7 +75,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -89,7 +89,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] +searches = ["ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -124,7 +124,7 @@ version = 1 references = ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule"] +searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 - Rule"] description = Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. narrative = A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection. @@ -135,7 +135,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -148,13 +148,40 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +searches = ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \ This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches. +[analytic_story://Cloud Federated Credential Abuse] +category = Cloud Security +last_updated = 2021-01-26 +version = 1 +references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] +spec_version = 3 +searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Certutil exe certificate extraction - Rule"] +description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. +narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. + +[analytic_story://Cobalt Strike] +category = Adversary Tactics +last_updated = 2021-02-16 +version = 1 +references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule"] +description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\ +In generating content for Cobalt Strike, the following is considered:\ +1. Is it normal for to have no command line arguments? No command line arguments and a network connection?\ +1. What is the default, or normal, process lineage for ?\ +1. Does the make network connections?\ +1. Is it normal for to load jscript, vbscript, Amsi.dll, and clr.dll?. + [analytic_story://ColdRoot MacOS RAT] category = Malware last_updated = 2019-01-09 @@ -175,7 +202,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -188,7 +215,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -223,7 +250,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task"] +searches = ["ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Ntdsutil export ntds - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -236,7 +263,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -262,7 +289,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -292,7 +319,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -303,7 +330,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -314,7 +341,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -325,7 +352,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -336,7 +363,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -360,7 +387,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -373,7 +400,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task"] +searches = ["ESCU - Suspicious File Write - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -387,7 +414,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Windows hosts file modification - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website. narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications. @@ -423,7 +450,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -434,7 +461,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -445,7 +472,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -456,7 +483,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -471,7 +498,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -527,7 +554,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -539,7 +566,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 Disable MFA - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 PST export alert - Rule"] +searches = ["ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 New Federated Domain Added - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -550,7 +577,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -564,7 +591,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Get Parent Process Info - Response Task"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -582,7 +609,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -620,7 +647,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -631,7 +658,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -653,7 +680,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Port Security Violation - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -665,7 +692,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Ryuk Test Files Detected - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Common Ransomware Notes - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -688,7 +715,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -749,7 +776,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - First Time Seen Running Windows Service - Rule"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - TOR Traffic - Rule"] description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. @@ -760,7 +787,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -771,7 +798,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -782,7 +809,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -795,7 +822,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -809,7 +836,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by New User - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect AWS Console Login by New User - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -832,7 +859,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -844,7 +871,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -856,10 +883,24 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. +[analytic_story://Suspicious Compiled HTML Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + [analytic_story://Suspicious DNS Traffic] category = Adversary Tactics last_updated = 2017-09-18 @@ -867,7 +908,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] +searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -878,7 +919,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -890,10 +931,10 @@ Once a phishing message has been detected, the next steps are to answer the foll category = Cloud Security last_updated = 2020-08-05 version = 1 -references = ["https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] +references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -904,11 +945,17 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious mshta spawn - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect mshta renamed - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ -The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 2. Determine if script code was executed with MSHTA. \ Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ +Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\ +1. Determine if script code was executed with MSHTA.\ +Situational Awareness\ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ The objective of this step is to confirm the executed script code is benign or malicious. [analytic_story://Suspicious Okta Activity] category = Adversary Tactics @@ -917,12 +964,45 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Okta Account Lockout Events - Rule", "ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +searches = ["ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. +[analytic_story://Suspicious Regsvcs Regasm Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + +[analytic_story://Suspicious Regsvr32 Activity] +category = Adversary Tactics +last_updated = 2021-01-29 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/010/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md", "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule"] +description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. +narrative = One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious. + +[analytic_story://Suspicious Rundll32 Activity] +category = Adversary Tactics +last_updated = 2021-02-03 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Suspicious Rundll32 Rename - Rule"] +description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. +narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. + [analytic_story://Suspicious WMI Use] category = Adversary Tactics last_updated = 2018-10-23 @@ -930,7 +1010,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Script Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ @@ -943,7 +1023,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -956,7 +1036,7 @@ version = 1 references = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Get Process File Activity - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Response Task"] description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. @@ -980,12 +1060,22 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious msbuild path - Rule"] +searches = ["ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. -narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. \ -The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution. \ -The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata. 2. Determine if script code was executed with MSBuild. Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ +The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\ +Triage\ +Validate execution\ +1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata.\ +1. Determine if script code was executed with MSBuild.\ +Situational Awareness\ +The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ +The objective of this step is to confirm the executed script code is benign or malicious. [analytic_story://Unusual AWS EC2 Modifications] category = Cloud Security @@ -994,7 +1084,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \ Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior. @@ -1006,7 +1096,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1030,7 +1120,7 @@ version = 1 references = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jim Apger"}] spec_version = 3 -searches = ["ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] +searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\ @@ -1057,7 +1147,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1068,7 +1158,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1083,7 +1173,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1095,7 +1185,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1106,7 +1196,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1117,7 +1207,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1229,6 +1319,26 @@ annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] +[savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule] +type = detection +asset_type = AWS Federated Account +confidence = medium +explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +annotations = {"mitre_attack": ["T1078"]} +known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. +providing_technologies = [] + +[savedsearch://ESCU - AWS SAML Update identity provider - Rule] +type = detection +asset_type = AWS Federated Account +confidence = medium +explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +annotations = {"mitre_attack": ["T1078"]} +known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. +providing_technologies = [] + [savedsearch://ESCU - Abnormally High AWS Instances Launched by User - Rule] type = detection asset_type = AWS Instance @@ -1399,6 +1509,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] +[savedsearch://ESCU - Certutil exe certificate extraction - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. +how_to_implement = +annotations = {"kill_chain_phases": ["Installation"]} +known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. +providing_technologies = [] + [savedsearch://ESCU - Child Processes of Spoolsv exe - Rule] type = detection asset_type = Endpoint @@ -1554,7 +1674,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. -how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files. providing_technologies = [] @@ -1593,10 +1713,10 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = Monitor for signs that Ntdsutil, Vssadmin, or Wmic has been used to create a shadow copy. +explanation = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} -known_false_positives = Legtimate administrator usage of Ntdsutil, Vssadmin, or Wmic will create false positives. +known_false_positives = Legitimate administrator usage of Vssadmin or Wmic will create false positives. providing_technologies = [] [savedsearch://ESCU - Creation of Shadow Copy with wmic and powershell - Rule] @@ -1604,11 +1724,21 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search detects the use of wmic and Powershell to create a shadow copy. -how_to_implement = none +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} known_false_positives = Legtimate administrator usage of wmic to create a shadow copy. providing_technologies = [] +[savedsearch://ESCU - Creation of lsass Dump with Taskmgr - Rule] +type = detection +asset_type = Windows +confidence = medium +explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. +providing_technologies = [] + [savedsearch://ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule] type = detection asset_type = Endpoint @@ -1889,6 +2019,46 @@ annotations = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on known_false_positives = GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours. providing_technologies = [] +[savedsearch://ESCU - Detect HTML Help Renamed - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed hh.exe may be used. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect HTML Help Spawn Child Process - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect HTML Help URL in Command Line - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect IPv6 Network Infrastructure Threats - Rule] type = detection asset_type = Infrastructure @@ -1936,7 +2106,7 @@ confidence = medium explanation = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} -known_false_positives = Other tools can import the same DLLs. These tools should be part of a whtelist. +known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. providing_technologies = [] [savedsearch://ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule] @@ -1954,7 +2124,7 @@ type = detection asset_type = Windows confidence = medium explanation = This search looks for newly created accounts that have been elevated to local administrators. -how_to_implement = none +how_to_implement = You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} known_false_positives = The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives providing_technologies = [] @@ -1984,7 +2154,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. providing_technologies = [] @@ -2004,7 +2174,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. -how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. +how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk. providing_technologies = [] @@ -2024,7 +2194,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. -how_to_implement = none +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2069,6 +2239,77 @@ annotations = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation" known_false_positives = Some legitimate processes may be only rarely executed in your environment. As these are identified, update `rare_process_allow_list_local.csv` to filter them out of your search results. providing_technologies = [] +[savedsearch://ESCU - Detect Regasm Spawning a Process - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regasm with Network Connection - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regasm with no Command Line Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvcs Spawning a Process - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvcs with Network Connection - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvcs with No Command Line Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvr32 Application Control Bypass - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ +Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe. +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +known_false_positives = Limited false positives related to third party software registering .DLL's. +providing_technologies = [] + [savedsearch://ESCU - Detect Rogue DHCP Server - Rule] type = detection asset_type = Infrastructure @@ -2079,6 +2320,36 @@ annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissan known_false_positives = This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface. providing_technologies = [] +[savedsearch://ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. +providing_technologies = [] + +[savedsearch://ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use setupapi triggering a false positive. +providing_technologies = [] + +[savedsearch://ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive. +providing_technologies = [] + [savedsearch://ESCU - Detect Rundll32 Inline HTA Execution - Rule] type = detection asset_type = Endpoint @@ -2346,7 +2617,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for fast execution of processes used for system network configuration discovery on the endpoint. -how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. +how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. providing_technologies = [] @@ -2388,7 +2659,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. providing_technologies = [] @@ -2403,6 +2674,28 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act known_false_positives = None identified. providing_technologies = [] +[savedsearch://ESCU - Dump LSASS via procdump - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +known_false_positives = None identified. +providing_technologies = [] + +[savedsearch://ESCU - Dump LSASS via procdump Rename - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +known_false_positives = None identified. +providing_technologies = [] + [savedsearch://ESCU - EC2 Instance Modified With Previously Unseen User - Rule] type = detection asset_type = AWS Instance @@ -2470,7 +2763,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. -how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} known_false_positives = Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. providing_technologies = [] @@ -2640,7 +2933,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -2960,7 +3253,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. annotations = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} known_false_positives = You will encounter noise from legitimate print-monitor registry entries. providing_technologies = [] @@ -2975,14 +3268,14 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": [" known_false_positives = None at this time providing_technologies = [] -[savedsearch://ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule] +[savedsearch://ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule] type = detection asset_type = Infrastructure confidence = medium explanation = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. +known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search. providing_technologies = [] [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule] @@ -3015,6 +3308,38 @@ annotations = {"cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} known_false_positives = None identified providing_technologies = [] +[savedsearch://ESCU - Ntdsutil export ntds - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ +ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ +This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +known_false_positives = Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives. +providing_technologies = [] + +[savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +providing_technologies = [] + +[savedsearch://ESCU - O365 Added Service Principal - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +providing_technologies = [] + [savedsearch://ESCU - O365 Bypass MFA via Trusted IP - Rule] type = detection asset_type = Office 365 @@ -3045,6 +3370,26 @@ annotations = {"kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110" known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives. providing_technologies = [] +[savedsearch://ESCU - O365 Excessive SSO logon errors - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} +known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack. +providing_technologies = [] + +[savedsearch://ESCU - O365 New Federated Domain Added - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects the addition of a new Federated domain. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. +providing_technologies = [] + [savedsearch://ESCU - O365 PST export alert - Rule] type = detection asset_type = Office 365 @@ -3060,7 +3405,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -3070,7 +3415,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Service Accounts providing_technologies = [] @@ -3080,7 +3425,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search detects when multiple user configured a forwarding rule to the same destination. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -3109,7 +3454,7 @@ providing_technologies = [] type = detection asset_type = Infrastructure confidence = medium -explanation = This search detects logins from the same user from different states in a 24 hour period. +explanation = This search detects logins from the same user from different cities in a 24 hour period. how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} known_false_positives = Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint. @@ -3150,7 +3495,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. +how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories. providing_technologies = [] @@ -3210,7 +3555,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for applications on the endpoint that you have marked as prohibited. -how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. +how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = None identified providing_technologies = [] @@ -3240,7 +3585,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -how_to_implement = none +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} known_false_positives = It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate. providing_technologies = [] @@ -3260,17 +3605,17 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} known_false_positives = There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. providing_technologies = [] [savedsearch://ESCU - Registry Keys Used For Privilege Escalation - Rule] type = detection -asset_type = Endpoint +asset_type = confidence = medium explanation = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. providing_technologies = [] @@ -3280,7 +3625,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response products, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications providing_technologies = [] @@ -3330,7 +3675,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search monitors for remote modifications to registry keys. -how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. +how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out. providing_technologies = [] @@ -3413,7 +3758,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. -how_to_implement = none +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. providing_technologies = [] @@ -3523,7 +3868,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for a sharp increase in the number of files written to a particular host -how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response products, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. +how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response product, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} known_false_positives = It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications. providing_technologies = [] @@ -3595,7 +3940,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for files created with names that have been linked to malicious activity. -how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. +how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate. providing_technologies = [] @@ -3640,6 +3985,56 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. providing_technologies = [] +[savedsearch://ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by legitimate processes. +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +known_false_positives = Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 Rename - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the OriginalFileName from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 StartW - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 dllregisterserver - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. +providing_technologies = [] + [savedsearch://ESCU - Suspicious microsoft workflow compiler rename - Rule] type = detection asset_type = Endpoint @@ -3725,7 +4120,7 @@ type = detection asset_type = Windows confidence = medium explanation = Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. -how_to_implement = none +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} known_false_positives = Administrators debugging servers providing_technologies = [] @@ -3762,7 +4157,7 @@ providing_technologies = [] [savedsearch://ESCU - Uncommon Processes On Endpoint - Rule] type = detection -asset_type = Endpoint +asset_type = confidence = medium explanation = This search looks for applications on the endpoint that you have marked as uncommon. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search uses a lookup file `uncommon_processes_default.csv` to track various features of process names that are usually uncommon in most environments. Please consider updating `uncommon_processes_local.csv` to hunt for processes that are uncommon in your environment. @@ -3965,7 +4360,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for modifications to the hosts file on all Windows endpoints across your environment. -how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. annotations = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} known_false_positives = There may be legitimate reasons for system administrators to add entries to this file. providing_technologies = [] diff --git a/package/default/app.conf b/package/default/app.conf index 7de04d2796..c4b2922b97 100644 --- a/package/default/app.conf +++ b/package/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 18409 +build = 19704 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.14.0 +version = 3.15.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/package/default/collections.conf b/package/default/collections.conf index 2e96f190c1..6a3c2777bc 100644 --- a/package/default/collections.conf +++ b/package/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:18 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/default/content-version.conf b/package/default/content-version.conf index 1be55fff51..8b71dc002e 100644 --- a/package/default/content-version.conf +++ b/package/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.14.0 +version = 3.15.0 diff --git a/package/default/es_investigations.conf b/package/default/es_investigations.conf index 71e5aee34b..58541a93bd 100644 --- a/package/default/es_investigations.conf +++ b/package/default/es_investigations.conf @@ -4,35 +4,35 @@ label = AWS Cross Account Activity description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task"] [panel_group://workbench_panel_group_aws_cryptomining] label = AWS Cryptomining description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] +panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_aws_network_acl_activity] label = AWS Network ACL Activity description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_aws_security_hub_alerts] label = AWS Security Hub Alerts description = This story is focused around detecting Security Hub alerts generated from AWS disabled = 0 -panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"] [panel_group://workbench_panel_group_aws_suspicious_provisioning_activities] label = AWS Suspicious Provisioning Activities description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. disabled = 0 -panels = ["panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task"] +panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task"] [panel_group://workbench_panel_group_aws_user_monitoring] label = AWS User Monitoring @@ -46,7 +46,7 @@ label = Apache Struts Vulnerability description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_investigate_web_posts_from_src___response_task"] +panels = ["panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_web_posts_from_src___response_task"] [panel_group://workbench_panel_group_asset_tracking] label = Asset Tracking @@ -67,14 +67,28 @@ label = Brand Monitoring description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task"] [panel_group://workbench_panel_group_cloud_cryptomining] label = Cloud Cryptomining description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task"] +panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task"] + +[panel_group://workbench_panel_group_cloud_federated_credential_abuse] +label = Cloud Federated Credential Abuse +description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + +[panel_group://workbench_panel_group_cobalt_strike] +label = Cobalt Strike +description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_coldroot_macos_rat] label = ColdRoot MacOS RAT @@ -95,7 +109,7 @@ label = Command and Control description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_common_phishing_frameworks] label = Common Phishing Frameworks @@ -116,14 +130,14 @@ label = Credential Dumping description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. disabled = 0 -panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task", "panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task"] +panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task"] [panel_group://workbench_panel_group_dhs_report_ta18_074a] label = DHS Report TA18-074A description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_dns_amplification_attacks] label = DNS Amplification Attacks @@ -151,7 +165,7 @@ label = Data Protection description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_detect_zerologon_attack] label = Detect Zerologon Attack @@ -172,14 +186,14 @@ label = Dynamic DNS description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task"] [panel_group://workbench_panel_group_emotet_malware__dhs_report_ta18_201a_] label = Emotet Malware DHS Report TA18-201A description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_f5_tmui_rce_cve_2020_5902] label = F5 TMUI RCE CVE-2020-5902 @@ -200,7 +214,7 @@ label = Hidden Cobra Malware description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_host_redirection] label = Host Redirection @@ -242,14 +256,14 @@ label = Lateral Movement description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_malicious_powershell] label = Malicious PowerShell description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_monitor_backup_solution] label = Monitor Backup Solution @@ -291,7 +305,7 @@ label = Orangeworm Attack Group description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_phishing_payloads] label = Phishing Payloads @@ -305,21 +319,21 @@ label = Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch] label = Prohibited Traffic Allowed or Protocol Mismatch description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_ransomware] label = Ransomware description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_ransomware_cloud] label = Ransomware Cloud @@ -354,7 +368,7 @@ label = SamSam Ransomware description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_spectre_and_meltdown_vulnerabilities] label = Spectre And Meltdown Vulnerabilities @@ -389,7 +403,7 @@ label = Suspicious AWS EC2 Activities description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task"] +panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task"] [panel_group://workbench_panel_group_suspicious_aws_login_activities] label = Suspicious AWS Login Activities @@ -403,14 +417,14 @@ label = Suspicious AWS S3 Activities description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"] +panels = ["panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"] [panel_group://workbench_panel_group_suspicious_aws_traffic] label = Suspicious AWS Traffic description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_authentication_activities] label = Suspicious Cloud Authentication Activities @@ -447,19 +461,26 @@ disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] +[panel_group://workbench_panel_group_suspicious_compiled_html_activity] +label = Suspicious Compiled HTML Activity +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_suspicious_dns_traffic] label = Suspicious DNS Traffic description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task"] +panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] [panel_group://workbench_panel_group_suspicious_emails] label = Suspicious Emails description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task"] +panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task"] [panel_group://workbench_panel_group_suspicious_gcp_storage_activities] label = Suspicious GCP Storage Activities @@ -480,14 +501,35 @@ label = Suspicious Okta Activity description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. disabled = 0 -panels = ["panel://workbench_panel_investigate_user_activities_in_okta___response_task", "panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task"] +panels = ["panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task", "panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task"] + +[panel_group://workbench_panel_group_suspicious_regsvcs_regasm_activity] +label = Suspicious Regsvcs Regasm Activity +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + +[panel_group://workbench_panel_group_suspicious_regsvr32_activity] +label = Suspicious Regsvr32 Activity +description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + +[panel_group://workbench_panel_group_suspicious_rundll32_activity] +label = Suspicious Rundll32 Activity +description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_wmi_use] label = Suspicious WMI Use description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task"] +panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_suspicious_windows_registry_activities] label = Suspicious Windows Registry Activities @@ -522,7 +564,7 @@ label = Unusual AWS EC2 Modifications description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_unusual_processes] label = Unusual Processes @@ -543,7 +585,7 @@ label = Web Fraud Detection description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task"] [panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350] label = Windows DNS SIGRed CVE-2020-1350 diff --git a/package/default/macros.conf b/package/default/macros.conf index 9f22535274..1c26743151 100644 --- a/package/default/macros.conf +++ b/package/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:19 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -331,6 +331,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_saml_access_by_provider_user_and_principal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_saml_update_identity_provider_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [abnormally_high_aws_instances_launched_by_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -399,6 +407,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[certutil_exe_certificate_extraction_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [child_processes_of_spoolsv_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -479,6 +491,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[creation_of_lsass_dump_with_taskmgr_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [credential_dumping_via_copy_command_from_shadow_copy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -579,6 +595,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_html_help_renamed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_spawn_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_using_infotech_storage_handlers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_ipv6_network_infrastructure_threats_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -651,10 +683,50 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_regasm_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_with_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_with_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_with_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_with_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvr32_application_control_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_rogue_dhcp_server_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_rundll32_application_control_bypass___advpack_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___setupapi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___syssetup_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_rundll32_inline_hta_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -779,6 +851,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[dump_lsass_via_procdump_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_procdump_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [ec2_instance_modified_with_previously_unseen_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1007,7 +1087,7 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter] +[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1023,6 +1103,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[ntdsutil_export_ntds_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_add_app_role_assignment_grant_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_added_service_principal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [o365_bypass_mfa_via_trusted_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1035,6 +1127,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[o365_excessive_sso_logon_errors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_new_federated_domain_added_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [o365_pst_export_alert_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1271,6 +1371,26 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[suspicious_regsvr32_register_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_startw_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_dllregisterserver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_no_commandline_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [suspicious_microsoft_workflow_compiler_rename_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/package/default/savedsearches.conf b/package/default/savedsearches.conf index a59f15abff..5a0fb394bc 100644 --- a/package/default/savedsearches.conf +++ b/package/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:18 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -35,14 +35,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen City -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -76,14 +70,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen Country -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -117,14 +105,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen IP Address -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -158,14 +140,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen Region -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -203,7 +179,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -237,13 +213,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ransomware Cloud"], "mitre_attack": ["T1486"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], "mitre_attack": ["T1486"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. -action.notable.param.rule_title = AWS Detect Users creating keys with encrypt policy without MFA -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -276,14 +247,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ransomware Cloud"], "mitre_attack": ["T1486"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware Cloud"], "mitre_attack": ["T1486"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'src'] -action.notable.param.rule_description = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. -action.notable.param.rule_title = AWS Detect Users with KMS keys performing encryption S3 -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -316,13 +281,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets -action.notable.param.rule_title = AWS EKS Kubernetes cluster sensitive object access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -360,14 +320,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Network Access Control List Created with All Open Ports - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -action.notable.param.rule_title = AWS Network Access Control List Created with All Open Ports -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -405,14 +359,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Network Access Control List Deleted - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. -action.notable.param.rule_title = AWS Network Access Control List Deleted -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -423,6 +371,74 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter` +[ESCU - AWS SAML Access by Provider User and Principal - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. +action.escu.mappings = {"mitre_attack": ["T1078"]} +action.escu.data_models = [] +action.escu.eli5 = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +action.escu.known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - AWS SAML Access by Provider User and Principal - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - AWS SAML Access by Provider User and Principal - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "mitre_attack": ["T1078"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_access_by_provider_user_and_principal_filter` + +[ESCU - AWS SAML Update identity provider - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. +action.escu.mappings = {"mitre_attack": ["T1078"]} +action.escu.data_models = [] +action.escu.eli5 = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +action.escu.known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - AWS SAML Update identity provider - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - AWS SAML Update identity provider - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "mitre_attack": ["T1078"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter` + [ESCU - Abnormally High AWS Instances Launched by User - Rule] action.escu = 0 action.escu.enabled = 1 @@ -450,13 +466,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High AWS Instances Launched by User - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel -action.notable.param.rule_title = Abnormally High AWS Instances Launched by User -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -494,14 +505,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = Abnormally High AWS Instances Launched by User - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -534,13 +539,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High AWS Instances Terminated by User - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = Abnormally High AWS Instances Terminated by User -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -573,14 +573,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = Abnormally High AWS Instances Terminated by User - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -618,7 +612,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -657,7 +651,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -696,7 +690,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule -action.correlationsearch.annotations = {"analytics_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -735,7 +729,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -769,7 +763,7 @@ dispatch.earliest_time = -30m@m dispatch.latest_time = now action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Access LSASS Memory for Dump Creation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -809,13 +803,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Amazon EKS Kubernetes Pod scan detection - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection information on unauthenticated requests against Kubernetes' Pods API -action.notable.param.rule_title = Amazon EKS Kubernetes Pod scan detection -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -848,13 +837,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Amazon EKS Kubernetes cluster scan detection - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS -action.notable.param.rule_title = Amazon EKS Kubernetes cluster scan detection -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -887,14 +871,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Add Certificate To Untrusted Store - Rule -action.correlationsearch.annotations = {"analytics_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = Attempt to add a certificate to the certificate store -action.notable.param.rule_title = Attempt To Add Certificate To Untrusted Store -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -923,11 +901,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule -action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell", "Credential Dumping"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -961,14 +939,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Stop Security Service - Rule -action.correlationsearch.annotations = {"analytics_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for attempts to stop security-related services on the endpoint. -action.notable.param.rule_title = Attempt To Stop Security Service -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -997,11 +969,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1035,14 +1007,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BCDEdit Failure Recovery Modification - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. -action.notable.param.rule_title = BCDEdit Failure Recovery Modification -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1075,14 +1041,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Batch File Write to System32 - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for a batch file (.bat) written to the Windows system directory tree. -action.notable.param.rule_title = Batch File Write to System32 -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1093,6 +1053,40 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex field=file_name "(?\.[^\.]+)$" | search file_path=*system32* AND file_extension=.bat | `batch_file_write_to_system32_filter` +[ESCU - Certutil exe certificate extraction - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. +action.escu.mappings = {"kill_chain_phases": ["Installation"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. +action.escu.how_to_implement = +action.escu.known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Certutil exe certificate extraction - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Certutil exe certificate extraction - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Installation"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` + [ESCU - Child Processes of Spoolsv exe - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1115,14 +1109,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Child Processes of Spoolsv exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Privilege Escalation"], "cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for child processes of spoolsv.exe. This activity is associated with a POC privilege-escalation exploit associated with CVE-2018-8440. Spoolsv.exe is the process associated with the Print Spooler service in Windows and typically runs as SYSTEM. -action.notable.param.rule_title = Child Processes of Spoolsv exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1157,14 +1145,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Clients Connecting to Multiple DNS Servers - Rule -action.correlationsearch.annotations = {"analytics_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search. -action.notable.param.rule_title = Clients Connecting to Multiple DNS Servers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1202,7 +1184,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1241,7 +1223,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytics_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1280,7 +1262,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule -action.correlationsearch.annotations = {"analytics_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1319,7 +1301,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule -action.correlationsearch.annotations = {"analytics_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1358,7 +1340,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule -action.correlationsearch.annotations = {"analytics_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1397,7 +1379,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Instance Modified By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1431,14 +1413,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Network Access Control List Deleted - Rule -action.correlationsearch.annotations = {"analytics_story": ["Cloud Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate -action.notable.param.rule_title = Cloud Network Access Control List Deleted -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1477,7 +1453,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1517,7 +1493,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1557,7 +1533,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1597,7 +1573,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1635,14 +1611,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Common Ransomware Extensions - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware", "Ryuk Ransonware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransonware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for file modifications with extensions commonly used by Ransomware -action.notable.param.rule_title = Common Ransomware Extensions -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1660,7 +1630,7 @@ description = The search looks for files created with names matching those typic action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. -action.escu.how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +action.escu.how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. action.escu.known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files. action.escu.creation_date = 2020-11-09 action.escu.modification_date = 2020-11-09 @@ -1675,14 +1645,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Common Ransomware Notes - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. -action.notable.param.rule_title = Common Ransomware Notes -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1711,11 +1675,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1749,14 +1713,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for the creation of local administrator accounts using net.exe. -action.notable.param.rule_title = Create local admin accounts using net exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1789,14 +1747,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create or delete windows shares using net exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for the creation or deletion of hidden shares using net.exe. -action.notable.param.rule_title = Create or delete windows shares using net exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -1810,12 +1762,12 @@ search = | tstats `security_content_summariesonly` count values(Processes.user) [ESCU - Creation of Shadow Copy - Rule] action.escu = 0 action.escu.enabled = 1 -description = Monitor for signs that Ntdsutil, Vssadmin, or Wmic has been used to create a shadow copy. +description = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = Monitor for signs that Ntdsutil, Vssadmin, or Wmic has been used to create a shadow copy. +action.escu.eli5 = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -action.escu.known_false_positives = Legtimate administrator usage of Ntdsutil, Vssadmin, or Wmic will create false positives. +action.escu.known_false_positives = Legitimate administrator usage of Vssadmin or Wmic will create false positives. action.escu.creation_date = 2019-12-10 action.escu.modification_date = 2019-12-10 action.escu.confidence = high @@ -1825,11 +1777,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1839,7 +1791,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*) OR (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter` [ESCU - Creation of Shadow Copy with wmic and powershell - Rule] action.escu = 0 @@ -1848,7 +1800,7 @@ description = This search detects the use of wmic and Powershell to create a sha action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search detects the use of wmic and Powershell to create a shadow copy. -action.escu.how_to_implement = none +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Legtimate administrator usage of wmic to create a shadow copy. action.escu.creation_date = 2019-12-10 action.escu.modification_date = 2019-12-10 @@ -1859,11 +1811,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1875,6 +1827,40 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic* OR Processes.process_name=powershell* Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter` +[ESCU - Creation of lsass Dump with Taskmgr - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.escu.how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. +action.escu.known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. +action.escu.creation_date = 2020-02-03 +action.escu.modification_date = 2020-02-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Creation of lsass Dump with Taskmgr - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp | stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter` + [ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1893,11 +1879,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1927,11 +1913,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1971,14 +1957,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Length Outliers - MLTK - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment. -action.notable.param.rule_title = DNS Query Length Outliers - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2011,13 +1991,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. -action.notable.param.rule_title = DNS Query Length With High Standard Deviation -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2050,14 +2025,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule -action.correlationsearch.annotations = {"analytics_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework. -action.notable.param.rule_title = DNS Query Requests Resolved by Unauthorized DNS Servers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2094,14 +2063,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS record changed - Rule -action.correlationsearch.annotations = {"analytics_story": ["DNS Hijacking"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day. -action.notable.param.rule_title = DNS record changed -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2134,14 +2097,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deleting Shadow Copies - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware"], "cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware"], "cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. -action.notable.param.rule_title = Deleting Shadow Copies -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2185,14 +2142,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect API activity from users without MFA - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. -action.notable.param.rule_title = Detect API activity from users without MFA -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2225,7 +2176,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src_interface', 'firstTime', 'lastTime', 'count'] @@ -2276,14 +2227,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AWS API Activities From Unapproved Accounts - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. -action.notable.param.rule_title = Detect AWS API Activities From Unapproved Accounts -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2321,7 +2266,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AWS Console Login by New User - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2360,7 +2305,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New City - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2399,7 +2344,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Country - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2438,7 +2383,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Region - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2472,14 +2417,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Activity Related to Pass the Hash Attacks - Rule -action.correlationsearch.annotations = {"analytics_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. -action.notable.param.rule_title = Detect Activity Related to Pass the Hash Attacks -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2512,13 +2451,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 - Rule -action.correlationsearch.annotations = {"analytics_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit -action.notable.param.rule_title = Detect Baron Samedit CVE-2021-3156 -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2551,13 +2485,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule -action.correlationsearch.annotations = {"analytics_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit -action.notable.param.rule_title = Detect Baron Samedit CVE-2021-3156 Segfault -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2590,13 +2519,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule -action.correlationsearch.annotations = {"analytics_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit -action.notable.param.rule_title = Detect Baron Samedit CVE-2021-3156 via OSQuery -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2629,14 +2553,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Computer Changed with Anonymous Account - Rule -action.correlationsearch.annotations = {"analytics_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account. -action.notable.param.rule_title = Detect Computer Changed with Anonymous Account -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2665,11 +2583,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2707,14 +2625,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule -action.correlationsearch.annotations = {"analytics_story": ["Common Phishing Frameworks"], "cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Common Phishing Frameworks"], "cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites. -action.notable.param.rule_title = Detect DNS requests to Phishing Sites leveraging EvilGinx2 -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2751,14 +2663,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive Account Lockouts From Endpoint - Rule -action.correlationsearch.annotations = {"analytics_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search identifies endpoints that have caused a relatively high number of account lockouts in a short period. -action.notable.param.rule_title = Detect Excessive Account Lockouts From Endpoint -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2791,14 +2697,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive User Account Lockouts - Rule -action.correlationsearch.annotations = {"analytics_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects user accounts that have been locked out a relatively high number of times in a short period. -action.notable.param.rule_title = Detect Excessive User Account Lockouts -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2831,13 +2731,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule -action.correlationsearch.annotations = {"analytics_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices -action.notable.param.rule_title = Detect F5 TMUI RCE CVE-2020-5902 -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2870,13 +2765,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect GCP Storage access from a new IP - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks at GCP Storage bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed a GCP Storage bucket. -action.notable.param.rule_title = Detect GCP Storage access from a new IP -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2887,6 +2777,142 @@ realtime_schedule = 0 is_visible = false search = `google_gcp_pubsub_message` | multikv | rename sc_status_ as status | rename cs_object_ as bucket_name | rename c_ip_ as remote_ip | rename cs_uri_ as request_uri | rename cs_method_ as operation | search status="\"200\"" | stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri | table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri | inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv | stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri | outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv | eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) | where newIP=1 | eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") | eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") | table first_time last_time bucket_name remote_ip operation request_uri | `detect_gcp_storage_access_from_a_new_ip_filter` +[ESCU - Detect HTML Help Renamed - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed hh.exe may be used. +action.escu.known_false_positives = Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. +action.escu.creation_date = 2021-02-11 +action.escu.modification_date = 2021-02-11 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect HTML Help Renamed - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect HTML Help Renamed - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter` + +[ESCU - Detect HTML Help Spawn Child Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. +action.escu.creation_date = 2021-02-11 +action.escu.modification_date = 2021-02-11 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect HTML Help Spawn Child Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter` + +[ESCU - Detect HTML Help URL in Command Line - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. +action.escu.creation_date = 2021-02-11 +action.escu.modification_date = 2021-02-11 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect HTML Help URL in Command Line - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process=*http* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_url_in_command_line_filter` + +[ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed. +action.escu.creation_date = 2021-02-11 +action.escu.modification_date = 2021-02-11 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter` + [ESCU - Detect IPv6 Network Infrastructure Threats - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2909,13 +2935,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect IPv6 Network Infrastructure Threats - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. -action.notable.param.rule_title = Detect IPv6 Network Infrastructure Threats -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2948,13 +2969,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Large Outbound ICMP Packets - Rule -action.correlationsearch.annotations = {"analytics_story": ["Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity. -action.notable.param.rule_title = Detect Large Outbound ICMP Packets -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2987,14 +3003,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Long DNS TXT Record Response - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses. -action.notable.param.rule_title = Detect Long DNS TXT Record Response -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3027,14 +3037,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -action.notable.param.rule_title = Detect MSHTA Url in Command Line -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3053,7 +3057,7 @@ action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Acti action.escu.data_models = [] action.escu.eli5 = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. action.escu.how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -action.escu.known_false_positives = Other tools can import the same DLLs. These tools should be part of a whtelist. +action.escu.known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. action.escu.creation_date = 2019-12-03 action.escu.modification_date = 2019-12-03 action.escu.confidence = high @@ -3061,13 +3065,13 @@ action.escu.full_search_name = ESCU - Detect Mimikatz Using Loaded Images - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] +action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3095,13 +3099,13 @@ action.escu.full_search_name = ESCU - Detect Mimikatz Via PowerShell And EventCo action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = [] +action.escu.analytic_story = ["Cloud Federated Credential Abuse"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule -action.correlationsearch.annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3120,7 +3124,7 @@ description = This search looks for newly created accounts that have been elevat action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for newly created accounts that have been elevated to local administrators. -action.escu.how_to_implement = none +action.escu.how_to_implement = You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 action.escu.known_false_positives = The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives action.escu.creation_date = 2020-07-08 action.escu.modification_date = 2020-07-08 @@ -3135,14 +3139,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule -action.correlationsearch.annotations = {"analytics_story": ["DHS Report TA18-074A"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for newly created accounts that have been elevated to local administrators. -action.notable.param.rule_title = Detect New Local Admin account -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3175,14 +3173,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Login Attempts to Routers - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days. -action.notable.param.rule_title = Detect New Login Attempts to Routers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3215,14 +3207,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Open GCP Storage Buckets - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'src'] -action.notable.param.rule_description = This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. -action.notable.param.rule_title = Detect New Open GCP Storage Buckets -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3240,7 +3226,7 @@ description = This search looks for CloudTrail events where a user has created a action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -action.escu.how_to_implement = none +action.escu.how_to_implement = action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. action.escu.creation_date = 2021-01-12 action.escu.modification_date = 2021-01-12 @@ -3260,13 +3246,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -action.notable.param.rule_title = Detect New Open S3 Buckets over AWS CLI -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3304,13 +3285,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for CloudTrail events where a user has created an open/public S3 bucket. -action.notable.param.rule_title = Detect New Open S3 buckets -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3328,7 +3304,7 @@ description = This search looks for execution of process `outlook.exe` where the action.escu.mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. -action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. +action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. action.escu.known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -3343,14 +3319,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Oulook exe writing a zip file - Rule -action.correlationsearch.annotations = {"analytics_story": ["Phishing Payloads"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Phishing Payloads"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. -action.notable.param.rule_title = Detect Oulook exe writing a zip file -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3383,13 +3353,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Outbound SMB Traffic - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "Sunburst Malware"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "Sunburst Malware"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. -action.notable.param.rule_title = Detect Outbound SMB Traffic -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3407,7 +3372,7 @@ description = The detection Detect Path Interception By Creation Of program exe action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. -action.escu.how_to_implement = none +action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. action.escu.known_false_positives = unknown action.escu.creation_date = 2020-07-03 action.escu.modification_date = 2020-07-03 @@ -3422,14 +3387,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Path Interception By Creation Of program exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. -action.notable.param.rule_title = Detect Path Interception By Creation Of program exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3438,7 +3397,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*\\\\(?.*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process)| where process_name != service_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest index | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter` [ESCU - Detect Port Security Violation - Rule] action.escu = 0 @@ -3462,13 +3421,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Port Security Violation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. -action.notable.param.rule_title = Detect Port Security Violation -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3501,14 +3455,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "Sunburst Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "Sunburst Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. -action.notable.param.rule_title = Detect Prohibited Applications Spawning cmd exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3541,14 +3489,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. -action.notable.param.rule_title = Detect PsExec With accepteula Flag -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3575,20 +3517,14 @@ action.escu.full_search_name = ESCU - Detect Rare Executables - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Unusual Processes"] +action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Unusual Processes", "Cloud Federated Credential Abuse"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rare Executables - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A ", "Unusual Processes"], "cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.PT", "PR.DS", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Unusual Processes", "Cloud Federated Credential Abuse"], "cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.PT", "PR.DS", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search will return a table of rare processes, the names of the systems running them, and the users who initiated each process. -action.notable.param.rule_title = Detect Rare Executables -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3599,6 +3535,246 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name | rename Processes.process_name as process | rex field=user "(?.*)\\\\(?.*)" | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search [| tstats count from datamodel=Endpoint.Processes by Processes.process_name | rare Processes.process_name limit=30 | rename Processes.process_name as process| `filter_rare_process_allow_list`| table process ] | `detect_rare_executables_filter` +[ESCU - Detect Regasm Spawning a Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +action.escu.creation_date = 2021-02-12 +action.escu.modification_date = 2021-02-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regasm Spawning a Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter` + +[ESCU - Detect Regasm with Network Connection - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +action.escu.creation_date = 2021-02-16 +action.escu.modification_date = 2021-02-16 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regasm with Network Connection - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter` + +[ESCU - Detect Regasm with no Command Line Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +action.escu.creation_date = 2021-02-12 +action.escu.modification_date = 2021-02-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regasm with no Command Line Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (process_name=regasm.exe OR OriginalFileName=RegAsm.exe) | regex CommandLine="(regasm\.exe.{0,4}$)" | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_no_command_line_arguments_filter` + +[ESCU - Detect Regsvcs Spawning a Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +action.escu.creation_date = 2021-02-12 +action.escu.modification_date = 2021-02-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regsvcs Spawning a Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter` + +[ESCU - Detect Regsvcs with Network Connection - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +action.escu.creation_date = 2021-02-16 +action.escu.modification_date = 2021-02-16 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regsvcs with Network Connection - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter` + +[ESCU - Detect Regsvcs with No Command Line Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +action.escu.creation_date = 2021-02-12 +action.escu.modification_date = 2021-02-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regsvcs with No Command Line Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvcs.exe) | regex CommandLine="(regsvcs\.exe.{0,4}$)" | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_no_command_line_arguments_filter` + +[ESCU - Detect Regsvr32 Application Control Bypass - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ +Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ +Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe. +action.escu.known_false_positives = Limited false positives related to third party software registering .DLL's. +action.escu.creation_date = 2021-01-28 +action.escu.modification_date = 2021-01-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Regsvr32 Application Control Bypass - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypass - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter` + [ESCU - Detect Rogue DHCP Server - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3621,7 +3797,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rogue DHCP Server - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src_mac', 'firstTime', 'lastTime', 'count', 'message_type'] @@ -3639,6 +3815,108 @@ realtime_schedule = 0 is_visible = false search = `cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" | stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| `detect_rogue_dhcp_server_filter` +[ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. +action.escu.creation_date = 2021-02-04 +action.escu.modification_date = 2021-02-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` + +[ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, some legitimate applications may use setupapi triggering a false positive. +action.escu.creation_date = 2021-02-04 +action.escu.modification_date = 2021-02-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` + +[ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive. +action.escu.creation_date = 2021-02-04 +action.escu.modification_date = 2021-02-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` + [ESCU - Detect Rundll32 Inline HTA Execution - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3661,14 +3939,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -action.notable.param.rule_title = Detect Rundll32 Inline HTA Execution -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3706,13 +3978,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect S3 access from a new IP - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket. -action.notable.param.rule_title = Detect S3 access from a new IP -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3745,13 +4012,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SNICat SNI Exfiltration - Rule -action.correlationsearch.annotations = {"analytics_story": ["Data Exfiltration"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["PR.DS", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["PR.DS", "DE.CM", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for commands that the SNICat tool uses in the TLS SNI field. -action.notable.param.rule_title = Detect SNICat SNI Exfiltration -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3784,14 +4046,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Software Download To Network Device - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. -action.notable.param.rule_title = Detect Software Download To Network Device -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3835,14 +4091,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in AWS API Activity - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = Detect Spike in AWS API Activity -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3875,14 +4125,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals -action.notable.param.rule_title = Detect Spike in AWS Security Hub Alerts for EC2 Instance -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3915,14 +4159,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. -action.notable.param.rule_title = Detect Spike in AWS Security Hub Alerts for User -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -3960,14 +4198,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in Network ACL Activity - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Network ACL Activity"], "cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = Detect Spike in Network ACL Activity -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4005,14 +4237,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in S3 Bucket deletion - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data. -action.notable.param.rule_title = Detect Spike in S3 Bucket deletion -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4050,14 +4276,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in Security Group Activity - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = Detect Spike in Security Group Activity -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4095,13 +4315,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data. -action.notable.param.rule_title = Detect Spike in blocked Outbound Traffic from your AWS -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4134,13 +4349,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Traffic Mirroring - Rule -action.correlationsearch.annotations = {"analytics_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. -action.notable.param.rule_title = Detect Traffic Mirroring -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4173,14 +4383,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect USB device insertion - Rule -action.correlationsearch.annotations = {"analytics_story": ["Data Protection"], "cis20": ["CIS 13"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Data Protection"], "cis20": ["CIS 13"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework. -action.notable.param.rule_title = Detect USB device insertion -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4213,13 +4417,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Unauthorized Assets by MAC address - Rule -action.correlationsearch.annotations = {"analytics_story": ["Asset Tracking"], "cis20": ["CIS 1"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Asset Tracking"], "cis20": ["CIS 1"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found. -action.notable.param.rule_title = Detect Unauthorized Assets by MAC address -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4252,14 +4451,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine -action.notable.param.rule_title = Detect Use of cmd exe to Launch Script Interpreters -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4292,13 +4485,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects SIGRed via Splunk Stream. -action.notable.param.rule_title = Detect Windows DNS SIGRed via Splunk Stream -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4331,13 +4519,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Zeek - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects SIGRed via Zeek DNS and Zeek Conn data. -action.notable.param.rule_title = Detect Windows DNS SIGRed via Zeek -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4370,13 +4553,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Zerologon via Zeek - Rule -action.correlationsearch.annotations = {"analytics_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC -action.notable.param.rule_title = Detect Zerologon via Zeek -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4409,14 +4587,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule -action.correlationsearch.annotations = {"analytics_story": ["JBoss Vulnerability", "SamSam Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"]} +action.correlationsearch.annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for specific GET or HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. JexBoss is described as the exploit tool of choice for this malicious activity. -action.notable.param.rule_title = Detect attackers scanning for vulnerable JBoss servers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4455,13 +4627,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect hosts connecting to dynamic domain providers - Rule -action.correlationsearch.annotations = {"analytics_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, block lists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. -action.notable.param.rule_title = Detect hosts connecting to dynamic domain providers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4494,14 +4661,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect malicious requests to exploit JBoss servers - Rule -action.correlationsearch.annotations = {"analytics_story": ["JBoss Vulnerability", "SamSam Ransomware"], "cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search is used to detect malicious HTTP requests crafted to exploit jmx-console in JBoss servers. The malicious requests have a long URL length, as the payload is embedded in the URL. -action.notable.param.rule_title = Detect malicious requests to exploit JBoss servers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4534,14 +4695,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. -action.notable.param.rule_title = Detect mshta inline hta execution -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4574,14 +4729,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta renamed - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. -action.notable.param.rule_title = Detect mshta renamed -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4619,14 +4768,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect new API calls from user roles - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS User Monitoring"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. -action.notable.param.rule_title = Detect new API calls from user roles -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4659,14 +4802,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect new user AWS Console Login - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. -action.notable.param.rule_title = Detect new user AWS Console Login -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4684,7 +4821,7 @@ description = This search looks for fast execution of processes used for system action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for fast execution of processes used for system network configuration discovery on the endpoint. -action.escu.how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. +action.escu.how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. action.escu.known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. action.escu.creation_date = 2020-11-10 action.escu.modification_date = 2020-11-10 @@ -4699,14 +4836,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect processes used for System Network Configuration Discovery - Rule -action.correlationsearch.annotations = {"analytics_story": ["Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for fast execution of processes used for system network configuration discovery on the endpoint. -action.notable.param.rule_title = Detect processes used for System Network Configuration Discovery -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4741,14 +4872,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect web traffic to dynamic domain providers - Rule -action.correlationsearch.annotations = {"analytics_story": ["Dynamic DNS"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]} +action.correlationsearch.annotations = {"analytic_story": ["Dynamic DNS"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search looks for web connections to dynamic DNS providers. -action.notable.param.rule_title = Detect web traffic to dynamic domain providers -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4781,14 +4906,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detection of DNS Tunnels - Rule -action.correlationsearch.annotations = {"analytics_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same. -action.notable.param.rule_title = Detection of DNS Tunnels -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4821,14 +4940,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detection of tools built by NirSoft - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for specific command-line arguments that may indicate the execution of tools made by Nirsoft, which are legitimate, but may be abused by attackers. -action.notable.param.rule_title = Detection of tools built by NirSoft -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4846,7 +4959,7 @@ description = The search looks for modifications to registry keys that control t action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. action.escu.known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. action.escu.creation_date = 2020-11-18 action.escu.modification_date = 2020-11-18 @@ -4861,14 +4974,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Remote User Account Control - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). -action.notable.param.rule_title = Disabling Remote User Account Control -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4895,13 +5002,13 @@ action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping"] +action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4913,6 +5020,78 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter` +[ESCU - Dump LSASS via procdump - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = None identified. +action.escu.creation_date = 2021-02-01 +action.escu.modification_date = 2021-02-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Dump LSASS via procdump - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter` + +[ESCU - Dump LSASS via procdump Rename - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = None identified. +action.escu.creation_date = 2021-02-01 +action.escu.modification_date = 2021-02-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Dump LSASS via procdump Rename - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Dump LSASS via procdump Rename - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter` + [ESCU - EC2 Instance Modified With Previously Unseen User - Rule] action.escu = 0 action.escu.enabled = 1 @@ -4940,14 +5119,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - EC2 Instance Modified With Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytics_story": ["Unusual AWS EC2 Modifications"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = EC2 Instance Modified With Previously Unseen User -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4985,13 +5158,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - EC2 Instance Started In Previously Unseen Region - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started -action.notable.param.rule_title = EC2 Instance Started In Previously Unseen Region -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5024,13 +5192,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - EC2 Instance Started With Previously Unseen AMI - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = EC2 Instance Started With Previously Unseen AMI -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5063,14 +5226,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = EC2 Instance Started With Previously Unseen Instance Type -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5103,14 +5260,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - EC2 Instance Started With Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel. -action.notable.param.rule_title = EC2 Instance Started With Previously Unseen User -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5145,13 +5296,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Email Attachments With Lots Of Spaces - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = Attackers often use spaces as a means to obfuscate an attachment's file extension. This search looks for messages with email attachments that have many spaces within the file names. -action.notable.param.rule_title = Email Attachments With Lots Of Spaces -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5169,7 +5315,7 @@ description = The search looks at the change-analysis data model and detects ema action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. action.escu.known_false_positives = Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -5184,14 +5330,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Email files written outside of the Outlook directory - Rule -action.correlationsearch.annotations = {"analytics_story": ["Collection and Staging"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. -action.notable.param.rule_title = Email files written outside of the Outlook directory -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5224,13 +5364,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Email servers sending high volume traffic to hosts - Rule -action.correlationsearch.annotations = {"analytics_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. -action.notable.param.rule_title = Email servers sending high volume traffic to hosts -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5263,13 +5398,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive DNS Failures - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences. -action.notable.param.rule_title = Excessive DNS Failures -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5302,14 +5432,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Execution of File With Spaces Before Extension - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view. -action.notable.param.rule_title = Execution of File With Spaces Before Extension -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5342,14 +5466,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Execution of File with Multiple Extensions - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. -action.notable.param.rule_title = Execution of File with Multiple Extensions -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5382,14 +5500,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Extended Period Without Successful Netbackup Backups - Rule -action.correlationsearch.annotations = {"analytics_story": ["Monitor Backup Solution"], "cis20": ["CIS 10"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"], "cis20": ["CIS 10"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring. -action.notable.param.rule_title = Extended Period Without Successful Netbackup Backups -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5422,14 +5534,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - File with Samsam Extension - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for file writes with extensions consistent with a SamSam ransomware attack. -action.notable.param.rule_title = File with Samsam Extension -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5462,14 +5568,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - First Time Seen Child Process of Zoom - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Zoom Child Processes"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen. -action.notable.param.rule_title = First Time Seen Child Process of Zoom -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5502,14 +5602,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - First Time Seen Running Windows Service - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Service Abuse", "Orangeworm Attack Group", "Sunburst Malware"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "Sunburst Malware"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached. -action.notable.param.rule_title = First Time Seen Running Windows Service -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5542,13 +5636,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - First time seen command line argument - Rule -action.correlationsearch.annotations = {"analytics_story": ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059.003"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059.003"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. -action.notable.param.rule_title = First time seen command line argument -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5581,13 +5670,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GCP Detect accounts with high risk roles by project - Rule -action.correlationsearch.annotations = {"analytics_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema. -action.notable.param.rule_title = GCP Detect accounts with high risk roles by project -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5620,14 +5704,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GCP Detect gcploit framework - Rule -action.correlationsearch.annotations = {"analytics_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'src'] -action.notable.param.rule_description = This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts. -action.notable.param.rule_title = GCP Detect gcploit framework -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5660,13 +5738,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GCP Detect high risk permissions by resource and account - Rule -action.correlationsearch.annotations = {"analytics_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges. -action.notable.param.rule_title = GCP Detect high risk permissions by resource and account -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5699,14 +5772,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GCP GCR container uploaded - Rule -action.correlationsearch.annotations = {"analytics_story": ["Container Implantation Monitoring and Investigation"], "mitre_attack": ["T1525"]} +action.correlationsearch.annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "mitre_attack": ["T1525"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path. -action.notable.param.rule_title = GCP GCR container uploaded -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5739,13 +5806,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GCP Kubernetes cluster pod scan detection - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster's pods -action.notable.param.rule_title = GCP Kubernetes cluster pod scan detection -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5778,13 +5840,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GCP Kubernetes cluster scan detection - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster -action.notable.param.rule_title = GCP Kubernetes cluster scan detection -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5817,14 +5874,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. -action.notable.param.rule_title = Hiding Files And Directories With Attrib exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5842,7 +5893,7 @@ description = This search will detect more than 5 login failures in Office365 Az action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. -action.escu.how_to_implement = none +action.escu.how_to_implement = action.escu.known_false_positives = unknown action.escu.creation_date = 2020-12-16 action.escu.modification_date = 2020-12-16 @@ -5857,14 +5908,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - High Number of Login Failures from a single source - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. -action.notable.param.rule_title = High Number of Login Failures from a single source -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5897,13 +5942,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hosts receiving high volume of network traffic from email server - Rule -action.correlationsearch.annotations = {"analytics_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. -action.notable.param.rule_title = Hosts receiving high volume of network traffic from email server -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5936,13 +5976,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Identify New User Accounts - Rule -action.correlationsearch.annotations = {"analytics_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week. -action.notable.param.rule_title = Identify New User Accounts -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -5975,13 +6010,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kerberoasting spn request with RC4 encryption - Rule -action.correlationsearch.annotations = {"analytics_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects a potential kerberoasting attack via service principal name requests -action.notable.param.rule_title = Kerberoasting spn request with RC4 encryption -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6014,13 +6044,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes AWS detect RBAC authorization by account - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences -action.notable.param.rule_title = Kubernetes AWS detect RBAC authorization by account -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6053,13 +6078,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes AWS detect most active service accounts by pod - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision -action.notable.param.rule_title = Kubernetes AWS detect most active service accounts by pod -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6092,13 +6112,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes AWS detect sensitive role access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets -action.notable.param.rule_title = Kubernetes AWS detect sensitive role access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6131,13 +6146,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI -action.notable.param.rule_title = Kubernetes AWS detect service accounts forbidden failure access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6170,14 +6180,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context -action.notable.param.rule_title = Kubernetes AWS detect suspicious kubectl calls -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6210,13 +6214,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure detect RBAC authorization by account - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences -action.notable.param.rule_title = Kubernetes Azure detect RBAC authorization by account -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6249,13 +6248,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb -action.notable.param.rule_title = Kubernetes Azure detect most active service accounts by pod namespace -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6288,13 +6282,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure detect sensitive object access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets -action.notable.param.rule_title = Kubernetes Azure detect sensitive object access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6327,13 +6316,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure detect sensitive role access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets -action.notable.param.rule_title = Kubernetes Azure detect sensitive role access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6366,13 +6350,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on Kubernetes service accounts with failure or forbidden access status -action.notable.param.rule_title = Kubernetes Azure detect service accounts forbidden failure access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6405,13 +6384,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information on rare Kubectl calls with IP, verb namespace and object access context -action.notable.param.rule_title = Kubernetes Azure detect suspicious kubectl calls -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6444,13 +6418,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure pod scan fingerprint - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure -action.notable.param.rule_title = Kubernetes Azure pod scan fingerprint -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6483,13 +6452,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes Azure scan fingerprint - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure -action.notable.param.rule_title = Kubernetes Azure scan fingerprint -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6522,14 +6486,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences -action.notable.param.rule_title = Kubernetes GCP detect RBAC authorizations by account -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6562,14 +6520,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes GCP detect most active service accounts by pod - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision -action.notable.param.rule_title = Kubernetes GCP detect most active service accounts by pod -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6602,14 +6554,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes GCP detect sensitive object access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets -action.notable.param.rule_title = Kubernetes GCP detect sensitive object access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6642,14 +6588,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes GCP detect sensitive role access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets -action.notable.param.rule_title = Kubernetes GCP detect sensitive role access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6682,14 +6622,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI -action.notable.param.rule_title = Kubernetes GCP detect service accounts forbidden failure access -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6722,14 +6656,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule -action.correlationsearch.annotations = {"analytics_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context -action.notable.param.rule_title = Kubernetes GCP detect suspicious kubectl calls -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6762,13 +6690,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Large Volume of DNS ANY Queries - Rule -action.correlationsearch.annotations = {"analytics_story": ["DNS Amplification Attacks"], "cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DNS Amplification Attacks"], "cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. -action.notable.param.rule_title = Large Volume of DNS ANY Queries -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6835,14 +6758,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule -action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient. -action.notable.param.rule_title = Malicious PowerShell Process - Connect To Internet With Hidden Window -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6875,14 +6792,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Encoded Command - Rule -action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell", "Sunburst Malware"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Sunburst Malware"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line. -action.notable.param.rule_title = Malicious PowerShell Process - Encoded Command -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6915,14 +6826,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule -action.correlationsearch.annotations = {"analytics_story": ["DHS Report TA18-074A"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy. -action.notable.param.rule_title = Malicious PowerShell Process - Execution Policy Bypass -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6955,14 +6860,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command -action.notable.param.rule_title = Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -6995,14 +6894,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule -action.correlationsearch.annotations = {"analytics_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. -action.notable.param.rule_title = Malicious PowerShell Process With Obfuscation Techniques -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7035,13 +6928,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor DNS For Brand Abuse - Rule -action.correlationsearch.annotations = {"analytics_story": ["Brand Monitoring"], "kill_chain_phases": ["Delivery", "Actions on Objectives"]} +action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring"], "kill_chain_phases": ["Delivery", "Actions on Objectives"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. -action.notable.param.rule_title = Monitor DNS For Brand Abuse -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7074,13 +6962,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Email For Brand Abuse - Rule -action.correlationsearch.annotations = {"analytics_story": ["Brand Monitoring", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse. -action.notable.param.rule_title = Monitor Email For Brand Abuse -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7098,7 +6981,7 @@ description = This search looks for registry activity associated with modificati action.escu.mappings = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} action.escu.data_models = [] action.escu.eli5 = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. action.escu.known_false_positives = You will encounter noise from legitimate print-monitor registry entries. action.escu.creation_date = 2020-11-23 action.escu.modification_date = 2020-11-23 @@ -7113,14 +6996,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Registry Keys for Print Monitors - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. -action.notable.param.rule_title = Monitor Registry Keys for Print Monitors -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7153,14 +7030,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Web Traffic For Brand Abuse - Rule -action.correlationsearch.annotations = {"analytics_story": ["Brand Monitoring"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse. -action.notable.param.rule_title = Monitor Web Traffic For Brand Abuse -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7171,7 +7042,7 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `brand_abuse_web` | `monitor_web_traffic_for_brand_abuse_filter` -[ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule] +[ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule] action.escu = 0 action.escu.enabled = 1 description = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. @@ -7179,11 +7050,11 @@ action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nis action.escu.data_models = [] action.escu.eli5 = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. action.escu.how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. -action.escu.known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. +action.escu.known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 action.escu.confidence = high -action.escu.full_search_name = ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule +action.escu.full_search_name = ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] @@ -7192,14 +7063,9 @@ cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.label = ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. -action.notable.param.rule_title = Multiple Okta Users With Invalid Credentails From The Same IP -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7208,7 +7074,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5| `multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter` +search = `okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` [ESCU - NLTest Domain Trust Discovery - Rule] action.escu = 0 @@ -7232,14 +7098,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - NLTest Domain Trust Discovery - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. -action.notable.param.rule_title = NLTest Domain Trust Discovery -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7272,14 +7132,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - New container uploaded to AWS ECR - Rule -action.correlationsearch.annotations = {"analytics_story": ["Container Implantation Monitoring and Investigation"], "mitre_attack": ["T1525"]} +action.correlationsearch.annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "mitre_attack": ["T1525"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'src'] -action.notable.param.rule_description = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. -action.notable.param.rule_title = New container uploaded to AWS ECR -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7312,14 +7166,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - No Windows Updates in a time frame - Rule -action.correlationsearch.annotations = {"analytics_story": ["Monitor for Updates"], "cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} +action.correlationsearch.annotations = {"analytic_story": ["Monitor for Updates"], "cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. Windows updates are typically released monthly and applied shortly thereafter. An endpoint that has not successfully applied an update in this time frame indicates the endpoint is not regularly being patched for some reason. -action.notable.param.rule_title = No Windows Updates in a time frame -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7330,6 +7178,112 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` max(_time) as lastTime from datamodel=Updates where Updates.status=Installed Updates.vendor_product="Microsoft Windows" by Updates.dest Updates.status Updates.vendor_product | rename Updates.dest as Host | rename Updates.status as "Update Status" | rename Updates.vendor_product as Product | eval isOutlier=if(lastTime <= relative_time(now(), "-60d@d"), 1, 0) | `security_content_ctime(lastTime)` | search isOutlier=1 | rename lastTime as "Last Update Time", | table Host, "Update Status", Product, "Last Update Time" | `no_windows_updates_in_a_time_frame_filter` +[ESCU - Ntdsutil export ntds - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ +ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ +This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ +ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ +This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. +action.escu.known_false_positives = Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives. +action.escu.creation_date = 2021-01-28 +action.escu.modification_date = 2021-01-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Ntdsutil export ntds - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Ntdsutil export ntds - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter` + +[ESCU - O365 Add App Role Assignment Grant User - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.escu.data_models = [] +action.escu.eli5 = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +action.escu.known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - O365 Add App Role Assignment Grant User - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - O365 Add App Role Assignment Grant User - Rule +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter` + +[ESCU - O365 Added Service Principal - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.escu.data_models = [] +action.escu.eli5 = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +action.escu.known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - O365 Added Service Principal - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - O365 Added Service Principal - Rule +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter` + [ESCU - O365 Bypass MFA via Trusted IP - Rule] action.escu = 0 action.escu.enabled = 1 @@ -7352,14 +7306,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Bypass MFA via Trusted IP - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. -action.notable.param.rule_title = O365 Bypass MFA via Trusted IP -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7392,14 +7340,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Disable MFA - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user -action.notable.param.rule_title = O365 Disable MFA -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7432,14 +7374,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Excessive Authentication Failures Alert - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes -action.notable.param.rule_title = O365 Excessive Authentication Failures Alert -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7450,6 +7386,74 @@ realtime_schedule = 0 is_visible = false search = `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter` +[ESCU - O365 Excessive SSO logon errors - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} +action.escu.data_models = [] +action.escu.eli5 = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. +action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +action.escu.known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - O365 Excessive SSO logon errors - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - O365 Excessive SSO logon errors - Rule +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter` + +[ESCU - O365 New Federated Domain Added - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects the addition of a new Federated domain. +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.escu.data_models = [] +action.escu.eli5 = This search detects the addition of a new Federated domain. +action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. +action.escu.known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. +action.escu.creation_date = 2021-01-26 +action.escu.modification_date = 2021-01-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - O365 New Federated Domain Added - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - O365 New Federated Domain Added - Rule +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter` + [ESCU - O365 PST export alert - Rule] action.escu = 0 action.escu.enabled = 1 @@ -7472,13 +7476,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 PST export alert - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content -action.notable.param.rule_title = O365 PST export alert -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7496,7 +7495,7 @@ description = This search detects when an admin configured a forwarding rule for action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. -action.escu.how_to_implement = none +action.escu.how_to_implement = action.escu.known_false_positives = unknown action.escu.creation_date = 2020-12-16 action.escu.modification_date = 2020-12-16 @@ -7511,14 +7510,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious Admin Email Forwarding - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. -action.notable.param.rule_title = O365 Suspicious Admin Email Forwarding -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7536,7 +7529,7 @@ description = This search detects the assignment of rights to accesss content fr action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. -action.escu.how_to_implement = none +action.escu.how_to_implement = action.escu.known_false_positives = Service Accounts action.escu.creation_date = 2020-12-15 action.escu.modification_date = 2020-12-15 @@ -7551,14 +7544,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious Rights Delegation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. -action.notable.param.rule_title = O365 Suspicious Rights Delegation -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7576,7 +7563,7 @@ description = This search detects when multiple user configured a forwarding rul action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search detects when multiple user configured a forwarding rule to the same destination. -action.escu.how_to_implement = none +action.escu.how_to_implement = action.escu.known_false_positives = unknown action.escu.creation_date = 2020-12-16 action.escu.modification_date = 2020-12-16 @@ -7591,14 +7578,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious User Email Forwarding - Rule -action.correlationsearch.annotations = {"analytics_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects when multiple user configured a forwarding rule to the same destination. -action.notable.param.rule_title = O365 Suspicious User Email Forwarding -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7631,13 +7612,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Okta Account Lockout Events - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = Detect Okta user lockout events -action.notable.param.rule_title = Okta Account Lockout Events -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7670,13 +7646,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Okta Failed SSO Attempts - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = Detect failed Okta SSO events -action.notable.param.rule_title = Okta Failed SSO Attempts -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7690,10 +7661,10 @@ search = `okta` displayMessage="User attempted unauthorized access to app" | sta [ESCU - Okta User Logins From Multiple Cities - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search detects logins from the same user from different states in a 24 hour period. +description = This search detects logins from the same user from different cities in a 24 hour period. action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = This search detects logins from the same user from different states in a 24 hour period. +action.escu.eli5 = This search detects logins from the same user from different cities in a 24 hour period. action.escu.how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. action.escu.known_false_positives = Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint. action.escu.creation_date = 2020-07-21 @@ -7709,14 +7680,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Okta User Logins From Multiple Cities - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search detects logins from the same user from different states in a 24 hour period. -action.notable.param.rule_title = Okta User Logins From Multiple Cities -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7749,13 +7714,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Open Redirect in Splunk Web - Rule -action.correlationsearch.annotations = {"analytics_story": ["Splunk Enterprise Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Splunk Enterprise Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. -action.notable.param.rule_title = Open Redirect in Splunk Web -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7788,13 +7748,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Osquery pack - ColdRoot detection - Rule -action.correlationsearch.annotations = {"analytics_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"]} +action.correlationsearch.annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for ColdRoot events from the osx-attacks osquery pack. -action.notable.param.rule_title = Osquery pack - ColdRoot detection -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7827,14 +7782,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Overwriting Accessibility Binaries - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries. -action.notable.param.rule_title = Overwriting Accessibility Binaries -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7852,7 +7801,7 @@ description = This search looks for a process launching an `*.lnk` file under `C action.escu.mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. +action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. action.escu.known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories. action.escu.creation_date = 2021-01-28 action.escu.modification_date = 2021-01-28 @@ -7867,14 +7816,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Creating LNK file in Suspicious Location - Rule -action.correlationsearch.annotations = {"analytics_story": ["Phishing Payloads"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Phishing Payloads"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -action.notable.param.rule_title = Process Creating LNK file in Suspicious Location -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7907,14 +7850,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Execution via WMI - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for processes launched via WMI. -action.notable.param.rule_title = Process Execution via WMI -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7947,13 +7884,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Processes Tapping Keyboard Events - Rule -action.correlationsearch.annotations = {"analytics_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP"]} +action.correlationsearch.annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input -action.notable.param.rule_title = Processes Tapping Keyboard Events -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -7986,14 +7918,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Processes created by netsh - Rule -action.correlationsearch.annotations = {"analytics_story": ["Netsh Abuse"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper .dll when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe that are executing commands via the command line. Deprecated because we have another detection of the same type. -action.notable.param.rule_title = Processes created by netsh -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8026,14 +7952,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Processes launching netsh - Rule -action.correlationsearch.annotations = {"analytics_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line. -action.notable.param.rule_title = Processes launching netsh -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8066,13 +7986,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Prohibited Network Traffic Allowed - Rule -action.correlationsearch.annotations = {"analytics_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for network traffic defined by port and transport layer protocol in the Enterprise Security lookup table "lookup_interesting_ports", that is marked as prohibited, and has an associated 'allow' action in the Network_Traffic data model. This could be indicative of a misconfigured network device. -action.notable.param.rule_title = Prohibited Network Traffic Allowed -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8090,7 +8005,7 @@ description = This search looks for applications on the endpoint that you have m action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for applications on the endpoint that you have marked as prohibited. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. action.escu.known_false_positives = None identified action.escu.creation_date = 2019-10-11 action.escu.modification_date = 2019-10-11 @@ -8105,14 +8020,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Prohibited Software On Endpoint - Rule -action.correlationsearch.annotations = {"analytics_story": ["Monitor for Unauthorized Software", "Emotet Malware DHS Report TA18-201A ", "SamSam Ransomware"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "Emotet Malware DHS Report TA18-201A ", "SamSam Ransomware"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for applications on the endpoint that you have marked as prohibited. -action.notable.param.rule_title = Prohibited Software On Endpoint -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8145,13 +8054,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Protocol or Port Mismatch - Rule -action.correlationsearch.annotations = {"analytics_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["DE.AE", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["DE.AE", "PR.AC"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected. -action.notable.param.rule_title = Protocol or Port Mismatch -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8184,14 +8088,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Protocols passing authentication in cleartext - Rule -action.correlationsearch.annotations = {"analytics_story": ["Use of Cleartext Protocols"], "cis20": ["CIS 9", "CIS 14"], "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Use of Cleartext Protocols"], "cis20": ["CIS 9", "CIS 14"], "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest', 'src'] -action.notable.param.rule_description = This search looks for cleartext protocols at risk of leaking credentials. Currently, this consists of legacy protocols such as telnet, POP3, IMAP, and non-anonymous FTP sessions. While some of these protocols can be used over SSL, they typically run on different assigned ports in those cases. -action.notable.param.rule_title = Protocols passing authentication in cleartext -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8209,7 +8107,7 @@ description = The search looks for reg.exe modifying registry keys that define W action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -action.escu.how_to_implement = none +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. action.escu.known_false_positives = It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate. action.escu.creation_date = 2020-11-26 action.escu.modification_date = 2020-11-26 @@ -8224,14 +8122,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -action.notable.param.rule_title = Reg exe Manipulating Windows Services Registry Keys -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8264,14 +8156,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Reg exe used to hide files directories via registry keys - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search looks for command-line arguments used to hide a file or directory using the reg add command. -action.notable.param.rule_title = Reg exe used to hide files directories via registry keys -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8289,7 +8175,7 @@ description = The search looks for modifications to registry keys that can be us action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. action.escu.known_false_positives = There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. action.escu.creation_date = 2020-11-27 action.escu.modification_date = 2020-11-27 @@ -8304,14 +8190,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys Used For Persistence - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -action.notable.param.rule_title = Registry Keys Used For Persistence -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8329,7 +8209,7 @@ description = This search looks for modifications to registry keys that can be u action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. action.escu.known_false_positives = There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. action.escu.creation_date = 2020-11-27 action.escu.modification_date = 2020-11-27 @@ -8338,20 +8218,14 @@ action.escu.full_search_name = ESCU - Registry Keys Used For Privilege Escalatio action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities"] +action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys Used For Privilege Escalation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -action.notable.param.rule_title = Registry Keys Used For Privilege Escalation -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8369,7 +8243,7 @@ description = This search looks for registry activity associated with applicatio action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -action.escu.how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response products, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. action.escu.known_false_positives = There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications action.escu.creation_date = 2020-11-26 action.escu.modification_date = 2020-11-26 @@ -8384,14 +8258,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys for Creating SHIM Databases - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -action.notable.param.rule_title = Registry Keys for Creating SHIM Databases -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8424,14 +8292,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Desktop Network Bruteforce - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic. -action.notable.param.rule_title = Remote Desktop Network Bruteforce -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8464,14 +8326,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Desktop Network Traffic - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search looks for network traffic on TCP/3389, the default port used by remote desktop. While remote desktop traffic is not uncommon on a network, it is usually associated with known hosts. This search will ignore common RDP sources and common RDP destinations so you can focus on the uncommon uses of remote desktop on your network. -action.notable.param.rule_title = Remote Desktop Network Traffic -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8504,14 +8360,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Desktop Process Running On System - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for the remote desktop process mstsc.exe running on systems upon which it doesn't typically run. This is accomplished by filtering out all systems that are noted in the `common_rdp_source category` in the Assets and Identity framework. -action.notable.param.rule_title = Remote Desktop Process Running On System -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8544,14 +8394,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Process Instantiation via WMI - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ransomware", "Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for wmic.exe being launched with parameters to spawn a process on a remote system. -action.notable.param.rule_title = Remote Process Instantiation via WMI -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8569,7 +8413,7 @@ description = This search monitors for remote modifications to registry keys. action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search monitors for remote modifications to registry keys. -action.escu.how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. +action.escu.how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. action.escu.known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out. action.escu.creation_date = 2020-03-02 action.escu.modification_date = 2020-03-02 @@ -8584,14 +8428,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Registry Key modifications - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search monitors for remote modifications to registry keys. -action.notable.param.rule_title = Remote Registry Key modifications -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8624,14 +8462,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote WMI Command Attempt - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for wmic.exe being launched with parameters to operate on remote systems. -action.notable.param.rule_title = Remote WMI Command Attempt -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8664,14 +8496,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule -action.correlationsearch.annotations = {"analytics_story": ["Unusual Processes"], "cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. -action.notable.param.rule_title = RunDLL Loading DLL By Ordinal -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8704,13 +8530,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ryuk Test Files Detected - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. -action.notable.param.rule_title = Ryuk Test Files Detected -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8743,14 +8564,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SMB Traffic Spike - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = This search looks for spikes in the number of Server Message Block (SMB) traffic connections. -action.notable.param.rule_title = SMB Traffic Spike -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8786,14 +8601,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SMB Traffic Spike - MLTK - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the number of Server Message Block (SMB) connections. -action.notable.param.rule_title = SMB Traffic Spike - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8826,14 +8635,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SQL Injection with Long URLs - Rule -action.correlationsearch.annotations = {"analytics_story": ["SQL Injection"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SQL Injection"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search looks for long URLs that have several SQL commands visible within them. -action.notable.param.rule_title = SQL Injection with Long URLs -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8866,14 +8669,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Samsam Test File Write - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation. -action.notable.param.rule_title = Samsam Test File Write -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8891,7 +8688,7 @@ description = This search looks for arguments to sc.exe indicating the creation action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. -action.escu.how_to_implement = none +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 @@ -8906,14 +8703,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "Sunburst Malware"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "Sunburst Malware"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. -action.notable.param.rule_title = Sc exe Manipulating Windows Services -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8946,14 +8737,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule -action.correlationsearch.annotations = {"analytics_story": ["DHS Report TA18-074A", "Sunburst Malware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Sunburst Malware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. -action.notable.param.rule_title = Scheduled Task Deleted Or Created via CMD -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -8986,14 +8771,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled tasks used in BadRabbit ransomware - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection -action.notable.param.rule_title = Scheduled tasks used in BadRabbit ransomware -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9026,14 +8805,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system - Rule -action.correlationsearch.annotations = {"analytics_story": ["Lateral Movement", "Sunburst Malware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "Sunburst Malware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for flags passed to schtasks.exe on the command-line that indicate a job is being scheduled on a remote system. -action.notable.param.rule_title = Schtasks scheduling job on remote system -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9066,14 +8839,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks used for forcing a reboot - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled. -action.notable.param.rule_title = Schtasks used for forcing a reboot -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9106,14 +8873,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Script Execution via WMI - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for scripts launched via WMI. -action.notable.param.rule_title = Script Execution via WMI -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9146,14 +8907,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Shim Database File Creation - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. -action.notable.param.rule_title = Shim Database File Creation -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9186,14 +8941,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Shim Database Installation With Suspicious Parameters - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. -action.notable.param.rule_title = Shim Database Installation With Suspicious Parameters -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9226,14 +8975,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Short Lived Windows Accounts - Rule -action.correlationsearch.annotations = {"analytics_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search detects accounts that were created and deleted in a short time period. -action.notable.param.rule_title = Short Lived Windows Accounts -action.notable.param.security_domain = access -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9266,13 +9009,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Single Letter Process On Endpoint - Rule -action.correlationsearch.annotations = {"analytics_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for process names that consist only of a single letter. -action.notable.param.rule_title = Single Letter Process On Endpoint -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9305,14 +9043,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spectre and Meltdown Vulnerable Systems - Rule -action.correlationsearch.annotations = {"analytics_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities. -action.notable.param.rule_title = Spectre and Meltdown Vulnerable Systems -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9330,7 +9062,7 @@ description = The search looks for a sharp increase in the number of files writt action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for a sharp increase in the number of files written to a particular host -action.escu.how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response products, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. +action.escu.how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response product, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. action.escu.known_false_positives = It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications. action.escu.creation_date = 2020-03-16 action.escu.modification_date = 2020-03-16 @@ -9345,14 +9077,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spike in File Writes - Rule -action.correlationsearch.annotations = {"analytics_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search looks for a sharp increase in the number of files written to a particular host -action.notable.param.rule_title = Spike in File Writes -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9385,14 +9111,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Splunk Enterprise Information Disclosure - Rule -action.correlationsearch.annotations = {"analytics_story": ["Splunk Enterprise Vulnerability CVE-2018-11409"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Splunk Enterprise Vulnerability CVE-2018-11409"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. -action.notable.param.rule_title = Splunk Enterprise Information Disclosure -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9425,14 +9145,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Sunburst Correlation DLL and Network Event - Rule -action.correlationsearch.annotations = {"analytics_story": ["Sunburst Malware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Sunburst Malware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost.exe. After a period of 12-14 days, the malware will attempt to resolve a subdomain of avsvmcloud.com. This detections will correlate both events. -action.notable.param.rule_title = Sunburst Correlation DLL and Network Event -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9465,14 +9179,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Supernova Webshell - Rule -action.correlationsearch.annotations = {"analytics_story": ["Sunburst Malware"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Sunburst Malware"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest', 'src'] -action.notable.param.rule_description = This search aims to detect the Supernova webshell used in the SUNBURST attack. -action.notable.param.rule_title = Supernova Webshell -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9505,14 +9213,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Changes to File Associations - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area. -action.notable.param.rule_title = Suspicious Changes to File Associations -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9545,14 +9247,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Email - UBA Anomaly - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA). -action.notable.param.rule_title = Suspicious Email - UBA Anomaly -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9587,13 +9283,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Email Attachment Extensions - Rule -action.correlationsearch.annotations = {"analytics_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for emails that have attachments with suspicious file extensions. -action.notable.param.rule_title = Suspicious Email Attachment Extensions -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9611,7 +9302,7 @@ description = The search looks for files created with names that have been linke action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for files created with names that have been linked to malicious activity. -action.escu.how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. +action.escu.how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. action.escu.known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate. action.escu.creation_date = 2019-04-25 action.escu.modification_date = 2019-04-25 @@ -9626,14 +9317,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious File Write - Rule -action.correlationsearch.annotations = {"analytics_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search looks for files created with names that have been linked to malicious activity. -action.notable.param.rule_title = Suspicious File Write -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9666,14 +9351,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Java Classes - Rule -action.correlationsearch.annotations = {"analytics_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 7", "CIS 12"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 7", "CIS 12"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest', 'src'] -action.notable.param.rule_description = This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts. -action.notable.param.rule_title = Suspicious Java Classes -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9706,14 +9385,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Rename - Rule -action.correlationsearch.annotations = {"analytics_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild. -action.notable.param.rule_title = Suspicious MSBuild Rename -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9746,14 +9419,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule -action.correlationsearch.annotations = {"analytics_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. -action.notable.param.rule_title = Suspicious MSBuild Spawn -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9786,14 +9453,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Reg exe Process - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances. -action.notable.param.rule_title = Suspicious Reg exe Process -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9804,6 +9465,176 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup process_id| table process_id dest] | `suspicious_reg_exe_process_filter` +[ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by legitimate processes. +action.escu.known_false_positives = Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues. +action.escu.creation_date = 2021-01-28 +action.escu.modification_date = 2021-01-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter` + +[ESCU - Suspicious Rundll32 Rename - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the OriginalFileName from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the OriginalFileName from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +action.escu.known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. +action.escu.creation_date = 2021-02-04 +action.escu.modification_date = 2021-02-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Rundll32 Rename - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Suspicious Rundll32 Rename - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_rundll32_rename_filter` + +[ESCU - Suspicious Rundll32 StartW - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed. +action.escu.creation_date = 2021-02-04 +action.escu.modification_date = 2021-02-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Rundll32 StartW - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_startw_filter` + +[ESCU - Suspicious Rundll32 dllregisterserver - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names. +action.escu.creation_date = 2021-02-09 +action.escu.modification_date = 2021-02-09 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Rundll32 dllregisterserver - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter` + +[ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. +action.escu.creation_date = 2021-02-09 +action.escu.modification_date = 2021-02-09 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE) | regex CommandLine="(rundll32\.exe.{0,4}$)" | stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_no_commandline_arguments_filter` + [ESCU - Suspicious microsoft workflow compiler rename - Rule] action.escu = 0 action.escu.enabled = 1 @@ -9826,14 +9657,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler rename - Rule -action.correlationsearch.annotations = {"analytics_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127, T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127, T1036.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect. -action.notable.param.rule_title = Suspicious microsoft workflow compiler rename -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9866,14 +9691,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler usage - Rule -action.correlationsearch.annotations = {"analytics_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies microsoft.workflow.compiler.exe usage. microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. It is not a commonly used process by many applications. -action.notable.param.rule_title = Suspicious microsoft workflow compiler usage -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9906,14 +9725,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule -action.correlationsearch.annotations = {"analytics_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild. -action.notable.param.rule_title = Suspicious msbuild path -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9946,14 +9759,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta child process - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. -action.notable.param.rule_title = Suspicious mshta child process -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -9986,14 +9793,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe. -action.notable.param.rule_title = Suspicious mshta spawn -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10026,14 +9827,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious wevtutil Usage - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs. -action.notable.param.rule_title = Suspicious wevtutil Usage -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10066,13 +9861,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious writes to System Volume Information - Rule -action.correlationsearch.annotations = {"analytics_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search detects writes to the 'System Volume Information' folder by something other than the System process. -action.notable.param.rule_title = Suspicious writes to System Volume Information -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10105,14 +9895,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious writes to windows Recycle Bin - Rule -action.correlationsearch.annotations = {"analytics_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search detects writes to the recycle bin by a process other than explorer.exe. -action.notable.param.rule_title = Suspicious writes to windows Recycle Bin -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10130,7 +9914,7 @@ description = Detect system information discovery techniques used by attackers t action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. -action.escu.how_to_implement = none +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Administrators debugging servers action.escu.creation_date = 2020-10-12 action.escu.modification_date = 2020-10-12 @@ -10145,14 +9929,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Information Discovery Detection - Rule -action.correlationsearch.annotations = {"analytics_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. -action.notable.param.rule_title = System Information Discovery Detection -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10185,14 +9963,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Processes Run From Unexpected Locations - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for system processes that normally run out of C:\Windows\System32\ or C:\Windows\SysWOW64 that are not run from that location. This can indicate a malicious process that is trying to hide as a legitimate process. -action.notable.param.rule_title = System Processes Run From Unexpected Locations -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10225,13 +9997,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - TOR Traffic - Rule -action.correlationsearch.annotations = {"analytics_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "Sunburst Malware"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "Sunburst Malware"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. -action.notable.param.rule_title = TOR Traffic -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10264,14 +10031,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - USN Journal Deletion - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal. -action.notable.param.rule_title = USN Journal Deletion -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10298,20 +10059,14 @@ action.escu.full_search_name = ESCU - Uncommon Processes On Endpoint - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Privilege Escalation", "Unusual Processes"] +action.escu.analytic_story = ["Windows Privilege Escalation", "Unusual Processes", "Cloud Federated Credential Abuse"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Uncommon Processes On Endpoint - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Privilege Escalation", "Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Unusual Processes", "Cloud Federated Credential Abuse"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for applications on the endpoint that you have marked as uncommon. -action.notable.param.rule_title = Uncommon Processes On Endpoint -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10344,14 +10099,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unload Sysmon Filter Driver - Rule -action.correlationsearch.annotations = {"analytics_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. -action.notable.param.rule_title = Unload Sysmon Filter Driver -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10380,11 +10129,11 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] cron_schedule = 0 * * * * -dispatch.earliest_time = -40m@m +dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unsigned Image Loaded by LSASS - Rule -action.correlationsearch.annotations = {"analytics_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -10418,13 +10167,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unsuccessful Netbackup backups - Rule -action.correlationsearch.annotations = {"analytics_story": ["Monitor Backup Solution"], "cis20": ["CIS 10"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"], "cis20": ["CIS 10"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search gives you the hosts where a backup was attempted and then failed. -action.notable.param.rule_title = Unsuccessful Netbackup backups -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10457,14 +10201,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unusually Long Command Line - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = Command lines that are extremely long may be indicative of malicious activity on your hosts. -action.notable.param.rule_title = Unusually Long Command Line -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10497,14 +10235,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unusually Long Command Line - MLTK - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user. -action.notable.param.rule_title = Unusually Long Command Line - MLTK -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10537,13 +10269,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unusually Long Content-Type Length - Rule -action.correlationsearch.annotations = {"analytics_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for unusually long strings in the Content-Type http header that the client sends the server. -action.notable.param.rule_title = Unusually Long Content-Type Length -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10576,14 +10303,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WBAdmin Delete System Backups - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. -action.notable.param.rule_title = WBAdmin Delete System Backups -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10616,14 +10337,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for the creation of WMI permanent event subscriptions. -action.notable.param.rule_title = WMI Permanent Event Subscription -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10656,14 +10371,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Sysmon - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for the creation of WMI permanent event subscriptions. -action.notable.param.rule_title = WMI Permanent Event Subscription - Sysmon -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10696,13 +10405,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WMI Temporary Event Subscription - Rule -action.correlationsearch.annotations = {"analytics_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for the creation of WMI temporary event subscriptions. -action.notable.param.rule_title = WMI Temporary Event Subscription -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10735,14 +10439,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Web Fraud - Account Harvesting - Rule -action.correlationsearch.annotations = {"analytics_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]} +action.correlationsearch.annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search is used to identify the creation of multiple user accounts using the same email domain name. -action.notable.param.rule_title = Web Fraud - Account Harvesting -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10775,13 +10473,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Web Fraud - Anomalous User Clickspeed - Rule -action.correlationsearch.annotations = {"analytics_story": ["Web Fraud Detection"], "cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session. -action.notable.param.rule_title = Web Fraud - Anomalous User Clickspeed -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10814,14 +10507,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Web Fraud - Password Sharing Across Accounts - Rule -action.correlationsearch.annotations = {"analytics_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "nist": ["DE.DP"]} +action.correlationsearch.annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "nist": ["DE.DP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search is used to identify user accounts that share a common password. -action.notable.param.rule_title = Web Fraud - Password Sharing Across Accounts -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10854,14 +10541,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Web Servers Executing Suspicious Processes - Rule -action.correlationsearch.annotations = {"analytics_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["PR.IP"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for suspicious processes on all systems labeled as web servers. -action.notable.param.rule_title = Web Servers Executing Suspicious Processes -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10894,14 +10575,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows AdFind Exe - Rule -action.correlationsearch.annotations = {"analytics_story": ["Sunburst Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Sunburst Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller. -action.notable.param.rule_title = Windows AdFind Exe -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10934,14 +10609,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. -action.notable.param.rule_title = Windows DisableAntiSpyware Registry -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10974,14 +10643,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Event Log Cleared - Rule -action.correlationsearch.annotations = {"analytics_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search looks for Windows events that indicate one of the Windows event logs has been purged. -action.notable.param.rule_title = Windows Event Log Cleared -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11014,13 +10677,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Security Account Manager Stopped - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. -action.notable.param.rule_title = Windows Security Account Manager Stopped -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11053,14 +10711,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows connhost exe started forcefully - Rule -action.correlationsearch.annotations = {"analytics_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. -action.notable.param.rule_title = Windows connhost exe started forcefully -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11078,7 +10730,7 @@ description = The search looks for modifications to the hosts file on all Window action.escu.mappings = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for modifications to the hosts file on all Windows endpoints across your environment. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. action.escu.known_false_positives = There may be legitimate reasons for system administrators to add entries to this file. action.escu.creation_date = 2018-11-02 action.escu.modification_date = 2018-11-02 @@ -11093,14 +10745,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows hosts file modification - Rule -action.correlationsearch.annotations = {"analytics_story": ["Host Redirection"], "cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Host Redirection"], "cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The search looks for modifications to the hosts file on all Windows endpoints across your environment. -action.notable.param.rule_title = Windows hosts file modification -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11133,13 +10779,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - aws detect attach to role policy - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of an user attaching itself to a different role trust policy. This can be used for lateral movement and escalation of privileges. -action.notable.param.rule_title = aws detect attach to role policy -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11172,13 +10813,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - aws detect permanent key creation - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of accounts creating permanent keys. Permanent keys are not created by default and they are only needed for programmatic calls. Creation of Permanent key is an important event to monitor. -action.notable.param.rule_title = aws detect permanent key creation -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11211,13 +10847,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - aws detect role creation - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of role creation by IAM users. Role creation is an event by itself if user is creating a new role with trust policies different than the available in AWS and it can be used for lateral movement and escalation of privileges. -action.notable.param.rule_title = aws detect role creation -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11250,13 +10881,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - aws detect sts assume role abuse - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. -action.notable.param.rule_title = aws detect sts assume role abuse -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11289,13 +10915,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - aws detect sts get session token abuse - Rule -action.correlationsearch.annotations = {"analytics_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1550"]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1550"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of suspicious use of sts:GetSessionToken. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. -action.notable.param.rule_title = aws detect sts get session token abuse -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -11328,13 +10949,8 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - gcp detect oauth token abuse - Rule -action.correlationsearch.annotations = {"analytics_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +action.correlationsearch.annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally. -action.notable.param.rule_title = gcp detect oauth token abuse -action.notable.param.security_domain = threat -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -12702,11 +12318,11 @@ search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FRO ### ESCU RESPONSE TASKS ### -[ESCU - AWS Investigate Security Hub alerts by dest - Response Task] +[response - AWS Investigate Security Hub alerts by dest - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS Investigate Security Hub alerts by dest - Response Task +action.escu.full_search_name = response - AWS Investigate Security Hub alerts by dest - Response Task description = This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). action.escu.creation_date = 2020-06-08 action.escu.modification_date = 2020-06-08 @@ -12723,11 +12339,11 @@ schedule_window = auto is_visible = false search = sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation -[ESCU - AWS Investigate User Activities By ARN - Response Task] +[response - AWS Investigate User Activities By ARN - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task +action.escu.full_search_name = response - AWS Investigate User Activities By ARN - Response Task description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. action.escu.creation_date = 2019-04-30 action.escu.modification_date = 2019-04-30 @@ -12744,11 +12360,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType -[ESCU - AWS Investigate User Activities By AccessKeyId - Response Task] +[response - AWS Investigate User Activities By AccessKeyId - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS Investigate User Activities By AccessKeyId - Response Task +action.escu.full_search_name = response - AWS Investigate User Activities By AccessKeyId - Response Task description = This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. action.escu.creation_date = 2018-06-08 action.escu.modification_date = 2018-06-08 @@ -12765,11 +12381,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage -[ESCU - AWS Network ACL Details from ID - Response Task] +[response - AWS Network ACL Details from ID - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS Network ACL Details from ID - Response Task +action.escu.full_search_name = response - AWS Network ACL Details from ID - Response Task description = This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID action.escu.creation_date = 2017-01-22 action.escu.modification_date = 2017-01-22 @@ -12786,11 +12402,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:description| rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* -[ESCU - AWS Network Interface details via resourceId - Response Task] +[response - AWS Network Interface details via resourceId - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS Network Interface details via resourceId - Response Task +action.escu.full_search_name = response - AWS Network Interface details via resourceId - Response Task description = This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface. action.escu.creation_date = 2018-05-07 action.escu.modification_date = 2018-05-07 @@ -12807,11 +12423,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp -[ESCU - AWS S3 Bucket details via bucketName - Response Task] +[response - AWS S3 Bucket details via bucketName - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - AWS S3 Bucket details via bucketName - Response Task +action.escu.full_search_name = response - AWS S3 Bucket details via bucketName - Response Task description = This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket. action.escu.creation_date = 2018-06-26 action.escu.modification_date = 2018-06-26 @@ -12828,11 +12444,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:config | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList -[ESCU - All backup logs for host - Response Task] +[response - All backup logs for host - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - All backup logs for host - Response Task +action.escu.full_search_name = response - All backup logs for host - Response Task description = Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. action.escu.creation_date = 2017-09-12 action.escu.modification_date = 2017-09-12 @@ -12849,11 +12465,11 @@ schedule_window = auto is_visible = false search = | search sourcetype="netbackup_logs" dest=$dest$ -[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] +[response - Amazon EKS Kubernetes activity by src ip - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task +action.escu.full_search_name = response - Amazon EKS Kubernetes activity by src ip - Response Task description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address action.escu.creation_date = 2020-04-13 action.escu.modification_date = 2020-04-13 @@ -12870,11 +12486,11 @@ schedule_window = auto is_visible = false search = sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip -[ESCU - GCP Kubernetes activity by src ip - Response Task] +[response - GCP Kubernetes activity by src ip - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - GCP Kubernetes activity by src ip - Response Task +action.escu.full_search_name = response - GCP Kubernetes activity by src ip - Response Task description = This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address action.escu.creation_date = 2020-04-13 action.escu.modification_date = 2020-04-13 @@ -12891,11 +12507,11 @@ schedule_window = auto is_visible = false search = sourcetype="google:gcp:pubsub:message" | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type -[ESCU - Get All AWS Activity From City - Response Task] +[response - Get All AWS Activity From City - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get All AWS Activity From City - Response Task +action.escu.full_search_name = response - Get All AWS Activity From City - Response Task description = This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. action.escu.creation_date = 2018-03-19 action.escu.modification_date = 2018-03-19 @@ -12912,11 +12528,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode -[ESCU - Get All AWS Activity From Country - Response Task] +[response - Get All AWS Activity From Country - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get All AWS Activity From Country - Response Task +action.escu.full_search_name = response - Get All AWS Activity From Country - Response Task description = This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. action.escu.creation_date = 2018-03-19 action.escu.modification_date = 2018-03-19 @@ -12933,11 +12549,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode -[ESCU - Get All AWS Activity From IP Address - Response Task] +[response - Get All AWS Activity From IP Address - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get All AWS Activity From IP Address - Response Task +action.escu.full_search_name = response - Get All AWS Activity From IP Address - Response Task description = This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. action.escu.creation_date = 2018-03-19 action.escu.modification_date = 2018-03-19 @@ -12954,11 +12570,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode -[ESCU - Get All AWS Activity From Region - Response Task] +[response - Get All AWS Activity From Region - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get All AWS Activity From Region - Response Task +action.escu.full_search_name = response - Get All AWS Activity From Region - Response Task description = This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. action.escu.creation_date = 2018-03-19 action.escu.modification_date = 2018-03-19 @@ -12975,11 +12591,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode -[ESCU - Get Backup Logs For Endpoint - Response Task] +[response - Get Backup Logs For Endpoint - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Backup Logs For Endpoint - Response Task +action.escu.full_search_name = response - Get Backup Logs For Endpoint - Response Task description = This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. action.escu.creation_date = 2017-09-14 action.escu.modification_date = 2017-09-14 @@ -12996,11 +12612,11 @@ schedule_window = auto is_visible = false search = | search sourcetype="netbackup_logs" COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature -[ESCU - Get Certificate logs for a domain - Response Task] +[response - Get Certificate logs for a domain - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Certificate logs for a domain - Response Task +action.escu.full_search_name = response - Get Certificate logs for a domain - Response Task description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. action.escu.creation_date = 2019-04-29 action.escu.modification_date = 2019-04-29 @@ -13017,11 +12633,11 @@ schedule_window = auto is_visible = false search = | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -[ESCU - Get DNS Server History for a host - Response Task] +[response - Get DNS Server History for a host - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get DNS Server History for a host - Response Task +action.escu.full_search_name = response - Get DNS Server History for a host - Response Task description = While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours. action.escu.creation_date = 2017-11-09 action.escu.modification_date = 2017-11-09 @@ -13038,11 +12654,11 @@ schedule_window = auto is_visible = false search = | search tag=dns src_ip=$src_ip$ dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count -[ESCU - Get DNS traffic ratio - Response Task] +[response - Get DNS traffic ratio - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get DNS traffic ratio - Response Task +action.escu.full_search_name = response - Get DNS traffic ratio - Response Task description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. action.escu.creation_date = 2017-11-09 action.escu.modification_date = 2017-11-09 @@ -13059,11 +12675,11 @@ schedule_window = auto is_visible = false search = | tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest| `drop_dm_object_name(All_Traffic)` | rename src as src_ip | rename dest as dest_ip | search src_ip=$src_ip$ | search dest_ip = $dest_ip | eval ratio = (bytes_out/bytes_in) | table ratio -[ESCU - Get EC2 Instance Details by instanceId - Response Task] +[response - Get EC2 Instance Details by instanceId - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get EC2 Instance Details by instanceId - Response Task +action.escu.full_search_name = response - Get EC2 Instance Details by instanceId - Response Task description = This search queries AWS description logs and returns all the information about a specific instance via the instanceId field action.escu.creation_date = 2018-02-12 action.escu.modification_date = 2018-02-12 @@ -13080,11 +12696,11 @@ schedule_window = auto is_visible = false search = | search sourcetype="aws:description" source="*:ec2_instances"| dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC -[ESCU - Get EC2 Launch Details - Response Task] +[response - Get EC2 Launch Details - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get EC2 Launch Details - Response Task +action.escu.full_search_name = response - Get EC2 Launch Details - Response Task description = This search returns some of the launch details for a EC2 instance. action.escu.creation_date = 2018-03-12 action.escu.modification_date = 2018-03-12 @@ -13101,11 +12717,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName -[ESCU - Get Email Info - Response Task] +[response - Get Email Info - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Email Info - Response Task +action.escu.full_search_name = response - Get Email Info - Response Task description = This search returns all the information Splunk might have collected a specific email message over the last 2 hours. action.escu.creation_date = 2017-11-09 action.escu.modification_date = 2017-11-09 @@ -13122,11 +12738,11 @@ schedule_window = auto is_visible = false search = | from datamodel Email.All_Email | search message_id=$message_id$ -[ESCU - Get Emails From Specific Sender - Response Task] +[response - Get Emails From Specific Sender - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Emails From Specific Sender - Response Task +action.escu.full_search_name = response - Get Emails From Specific Sender - Response Task description = This search returns all the emails from a specific sender over the last 24 and next hours. action.escu.creation_date = 2017-11-09 action.escu.modification_date = 2017-11-09 @@ -13143,11 +12759,11 @@ schedule_window = auto is_visible = false search = | from datamodel Email.All_Email | search src_user=$src_user$ -[ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task] +[response - Get First Occurrence and Last Occurrence of a MAC Address - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task +action.escu.full_search_name = response - Get First Occurrence and Last Occurrence of a MAC Address - Response Task description = This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network. action.escu.creation_date = 2017-09-13 action.escu.modification_date = 2017-09-13 @@ -13164,11 +12780,11 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` -[ESCU - Get History Of Email Sources - Response Task] +[response - Get History Of Email Sources - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get History Of Email Sources - Response Task +action.escu.full_search_name = response - Get History Of Email Sources - Response Task description = This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. action.escu.creation_date = 2019-02-21 action.escu.modification_date = 2019-02-21 @@ -13185,11 +12801,11 @@ schedule_window = auto is_visible = false search = |tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src |`drop_dm_object_name(All_Email)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search src=$src$ -[ESCU - Get Logon Rights Modifications For Endpoint - Response Task] +[response - Get Logon Rights Modifications For Endpoint - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Logon Rights Modifications For Endpoint - Response Task +action.escu.full_search_name = response - Get Logon Rights Modifications For Endpoint - Response Task description = This search allows you to retrieve any modifications to logon rights associated with a specific host. action.escu.creation_date = 2017-09-12 action.escu.modification_date = 2017-09-12 @@ -13206,11 +12822,11 @@ schedule_window = auto is_visible = false search = | search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature -[ESCU - Get Logon Rights Modifications For User - Response Task] +[response - Get Logon Rights Modifications For User - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Logon Rights Modifications For User - Response Task +action.escu.full_search_name = response - Get Logon Rights Modifications For User - Response Task description = This search allows you to retrieve any modifications to logon rights for a specific user account. action.escu.creation_date = 2019-02-27 action.escu.modification_date = 2019-02-27 @@ -13227,11 +12843,11 @@ schedule_window = auto is_visible = false search = | search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature -[ESCU - Get Notable History - Response Task] +[response - Get Notable History - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Notable History - Response Task +action.escu.full_search_name = response - Get Notable History - Response Task description = This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. action.escu.creation_date = 2017-09-20 action.escu.modification_date = 2017-09-20 @@ -13248,11 +12864,11 @@ schedule_window = auto is_visible = false search = | search `notable` | search dest=$dest$ | table _time, dest, rule_name, owner, priority, severity, status_description -[ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task] +[response - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task +action.escu.full_search_name = response - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task description = This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`. action.escu.creation_date = 2018-06-14 action.escu.modification_date = 2018-06-14 @@ -13269,11 +12885,11 @@ schedule_window = auto is_visible = false search = | from datamodel Email.All_Email | search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com | stats count earliest(_time) as firstTime, latest(_time) as lastTime values(dest) values(src) by src_user recipient | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -[ESCU - Get Parent Process Info - Response Task] +[response - Get Parent Process Info - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Parent Process Info - Response Task +action.escu.full_search_name = response - Get Parent Process Info - Response Task description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest action.escu.creation_date = 2019-02-28 action.escu.modification_date = 2019-02-28 @@ -13290,11 +12906,11 @@ schedule_window = auto is_visible = false search = | tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -[ESCU - Get Process File Activity - Response Task] +[response - Get Process File Activity - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Process File Activity - Response Task +action.escu.full_search_name = response - Get Process File Activity - Response Task description = This search returns the file activity for a specific process on a specific endpoint action.escu.creation_date = 2019-11-06 action.escu.modification_date = 2019-11-06 @@ -13311,11 +12927,11 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, Filesystem.action, _time | `drop_dm_object_name(Filesystem)` | search dest=$dest$ | search process_name=$process_name$ | table _time, process_name, dest, action, file_name, file_path -[ESCU - Get Process Info - Response Task] +[response - Get Process Info - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Process Info - Response Task +action.escu.full_search_name = response - Get Process Info - Response Task description = This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. action.escu.creation_date = 2019-04-01 action.escu.modification_date = 2019-04-01 @@ -13332,11 +12948,11 @@ schedule_window = auto is_visible = false search = | tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -[ESCU - Get Process Information For Port Activity - Response Task] +[response - Get Process Information For Port Activity - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Process Information For Port Activity - Response Task +action.escu.full_search_name = response - Get Process Information For Port Activity - Response Task description = This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. action.escu.creation_date = 2019-04-01 action.escu.modification_date = 2019-04-01 @@ -13353,11 +12969,11 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search dest=$dest$ | join dest type=inner [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search dest_port=$dest_port$ | rename src as dest] -[ESCU - Get Process Responsible For The DNS Traffic - Response Task] +[response - Get Process Responsible For The DNS Traffic - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Process Responsible For The DNS Traffic - Response Task +action.escu.full_search_name = response - Get Process Responsible For The DNS Traffic - Response Task description = While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic. action.escu.creation_date = 2019-04-01 action.escu.modification_date = 2019-04-01 @@ -13374,11 +12990,11 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src | `drop_dm_object_name(Ports)` | rename src as dest] -[ESCU - Get Sysmon WMI Activity for Host - Response Task] +[response - Get Sysmon WMI Activity for Host - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Sysmon WMI Activity for Host - Response Task +action.escu.full_search_name = response - Get Sysmon WMI Activity for Host - Response Task description = This search queries Sysmon WMI events for the host of interest. action.escu.creation_date = 2018-10-23 action.escu.modification_date = 2018-10-23 @@ -13395,11 +13011,11 @@ schedule_window = auto is_visible = false search = sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter -[ESCU - Get Web Session Information via session id - Response Task] +[response - Get Web Session Information via session id - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Get Web Session Information via session id - Response Task +action.escu.full_search_name = response - Get Web Session Information via session id - Response Task description = This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code. action.escu.creation_date = 2018-10-08 action.escu.modification_date = 2018-10-08 @@ -13416,11 +13032,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=stream:http session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status -[ESCU - Investigate AWS User Activities by user field - Response Task] +[response - Investigate AWS User Activities by user field - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task +action.escu.full_search_name = response - Investigate AWS User Activities by user field - Response Task description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. action.escu.creation_date = 2018-03-12 action.escu.modification_date = 2018-03-12 @@ -13437,11 +13053,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType -[ESCU - Investigate AWS activities via region name - Response Task] +[response - Investigate AWS activities via region name - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate AWS activities via region name - Response Task +action.escu.full_search_name = response - Investigate AWS activities via region name - Response Task description = This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user action.escu.creation_date = 2018-02-09 action.escu.modification_date = 2018-02-09 @@ -13458,11 +13074,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region -[ESCU - Investigate Failed Logins for Multiple Destinations - Response Task] +[response - Investigate Failed Logins for Multiple Destinations - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Failed Logins for Multiple Destinations - Response Task +action.escu.full_search_name = response - Investigate Failed Logins for Multiple Destinations - Response Task description = This search returns failed logins to multiple destinations by user. action.escu.creation_date = 2019-12-10 action.escu.modification_date = 2019-12-10 @@ -13479,11 +13095,11 @@ schedule_window = auto is_visible = false search = | tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search user=$user$ -[ESCU - Investigate Network Traffic From src ip - Response Task] +[response - Investigate Network Traffic From src ip - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Network Traffic From src ip - Response Task +action.escu.full_search_name = response - Investigate Network Traffic From src ip - Response Task description = This search allows you to find all the network traffic from a specific IP address. action.escu.creation_date = 2018-06-15 action.escu.modification_date = 2018-06-15 @@ -13500,11 +13116,11 @@ schedule_window = auto is_visible = false search = | from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$ -[ESCU - Investigate Okta Activity by IP Address - Response Task] +[response - Investigate Okta Activity by IP Address - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Okta Activity by IP Address - Response Task +action.escu.full_search_name = response - Investigate Okta Activity by IP Address - Response Task description = This search returns all okta events from a specific IP address. action.escu.creation_date = 2020-04-02 action.escu.modification_date = 2020-04-02 @@ -13521,11 +13137,11 @@ schedule_window = auto is_visible = false search = eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason -[ESCU - Investigate Okta Activity by app - Response Task] +[response - Investigate Okta Activity by app - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Okta Activity by app - Response Task +action.escu.full_search_name = response - Investigate Okta Activity by app - Response Task description = This search returns all okta events associated with a specific app action.escu.creation_date = 2020-04-02 action.escu.modification_date = 2020-04-02 @@ -13542,11 +13158,11 @@ schedule_window = auto is_visible = false search = eventtype=okta_log app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason -[ESCU - Investigate Pass the Hash Attempts - Response Task] +[response - Investigate Pass the Hash Attempts - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Pass the Hash Attempts - Response Task +action.escu.full_search_name = response - Investigate Pass the Hash Attempts - Response Task description = This search hunts for dumped NTLM hashes used for pass the hash. action.escu.creation_date = 2019-12-10 action.escu.modification_date = 2019-12-10 @@ -13563,11 +13179,11 @@ schedule_window = auto is_visible = false search = `wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | search dest=$dest$ -[ESCU - Investigate Pass the Ticket Attempts - Response Task] +[response - Investigate Pass the Ticket Attempts - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Pass the Ticket Attempts - Response Task +action.escu.full_search_name = response - Investigate Pass the Ticket Attempts - Response Task description = This search hunts for dumped kerberos ticket from LSASS memory. action.escu.creation_date = 2019-12-10 action.escu.modification_date = 2019-12-10 @@ -13584,11 +13200,11 @@ schedule_window = auto is_visible = false search = `wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where sum_count/max_count!=2 | rename new_user AS user -[ESCU - Investigate Previous Unseen User - Response Task] +[response - Investigate Previous Unseen User - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Previous Unseen User - Response Task +action.escu.full_search_name = response - Investigate Previous Unseen User - Response Task description = This search returns previous unseen user, which didn't log in for 30 days. action.escu.creation_date = 2019-12-10 action.escu.modification_date = 2019-12-10 @@ -13605,11 +13221,11 @@ schedule_window = auto is_visible = false search = | tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from datamodel=Authentication where Authentication.action=success by _time, Authentication.user | bucket _time span=30d | stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search dest=$dest$ -[ESCU - Investigate Successful Remote Desktop Authentications - Response Task] +[response - Investigate Successful Remote Desktop Authentications - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Successful Remote Desktop Authentications - Response Task +action.escu.full_search_name = response - Investigate Successful Remote Desktop Authentications - Response Task description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. action.escu.creation_date = 2018-12-14 action.escu.modification_date = 2018-12-14 @@ -13626,11 +13242,11 @@ schedule_window = auto is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app Authentication.user Authentication.signature Authentication.src_nt_domain | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")` | search dest=$dest$ | table firstTime lastTime src src_nt_domain dest user app count | sort count -[ESCU - Investigate Suspicious Strings in HTTP Header - Response Task] +[response - Investigate Suspicious Strings in HTTP Header - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Suspicious Strings in HTTP Header - Response Task +action.escu.full_search_name = response - Investigate Suspicious Strings in HTTP Header - Response Task description = This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest. action.escu.creation_date = 2017-10-20 action.escu.modification_date = 2017-10-20 @@ -13647,11 +13263,11 @@ schedule_window = auto is_visible = false search = | search sourcetype=stream:http | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url -[ESCU - Investigate User Activities In Okta - Response Task] +[response - Investigate User Activities In Okta - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate User Activities In Okta - Response Task +action.escu.full_search_name = response - Investigate User Activities In Okta - Response Task description = This search returns all okta events by a specific user action.escu.creation_date = 2020-04-02 action.escu.modification_date = 2020-04-02 @@ -13668,11 +13284,11 @@ schedule_window = auto is_visible = false search = eventtype=okta_log user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason -[ESCU - Investigate Web POSTs From src - Response Task] +[response - Investigate Web POSTs From src - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - Investigate Web POSTs From src - Response Task +action.escu.full_search_name = response - Investigate Web POSTs From src - Response Task description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. action.escu.creation_date = 2018-12-06 action.escu.modification_date = 2018-12-06 diff --git a/package/default/transforms.conf b/package/default/transforms.conf index 39412793d0..214c43014b 100644 --- a/package/default/transforms.conf +++ b/package/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:18 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/default/use_case_library.conf b/package/default/use_case_library.conf index f3fabc621c..500caeaccf 100644 --- a/package/default/use_case_library.conf +++ b/package/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-02-04T23:39:19 UTC +# On Date: 2021-02-18T18:09:13 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - aws detect role creation - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -27,7 +27,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -41,7 +41,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -52,7 +52,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -63,7 +63,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -75,7 +75,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -89,7 +89,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] +searches = ["ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -124,7 +124,7 @@ version = 1 references = ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule"] +searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 - Rule"] description = Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. narrative = A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection. @@ -135,7 +135,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -148,13 +148,40 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +searches = ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \ This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches. +[analytic_story://Cloud Federated Credential Abuse] +category = Cloud Security +last_updated = 2021-01-26 +version = 1 +references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] +spec_version = 3 +searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Certutil exe certificate extraction - Rule"] +description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. +narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. + +[analytic_story://Cobalt Strike] +category = Adversary Tactics +last_updated = 2021-02-16 +version = 1 +references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule"] +description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike.\ +In generating content for Cobalt Strike, the following is considered:\ +1. Is it normal for to have no command line arguments? No command line arguments and a network connection?\ +1. What is the default, or normal, process lineage for ?\ +1. Does the make network connections?\ +1. Is it normal for to load jscript, vbscript, Amsi.dll, and clr.dll?. + [analytic_story://ColdRoot MacOS RAT] category = Malware last_updated = 2019-01-09 @@ -175,7 +202,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -188,7 +215,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -223,7 +250,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task"] +searches = ["ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Ntdsutil export ntds - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -236,7 +263,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -262,7 +289,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -292,7 +319,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -303,7 +330,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -314,7 +341,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -325,7 +352,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -336,7 +363,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -360,7 +387,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -373,7 +400,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task"] +searches = ["ESCU - Suspicious File Write - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -387,7 +414,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Windows hosts file modification - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website. narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications. @@ -423,7 +450,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -434,7 +461,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -445,7 +472,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -456,7 +483,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -471,7 +498,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -527,7 +554,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -539,7 +566,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 Disable MFA - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 PST export alert - Rule"] +searches = ["ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 New Federated Domain Added - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -550,7 +577,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -564,7 +591,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Get Parent Process Info - Response Task"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -582,7 +609,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -620,7 +647,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -631,7 +658,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -653,7 +680,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Port Security Violation - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -665,7 +692,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Ryuk Test Files Detected - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Common Ransomware Notes - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -688,7 +715,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -749,7 +776,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - First Time Seen Running Windows Service - Rule"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - TOR Traffic - Rule"] description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. @@ -760,7 +787,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -771,7 +798,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -782,7 +809,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -795,7 +822,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -809,7 +836,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by New User - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect AWS Console Login by New User - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -832,7 +859,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -844,7 +871,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -856,10 +883,24 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. +[analytic_story://Suspicious Compiled HTML Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + [analytic_story://Suspicious DNS Traffic] category = Adversary Tactics last_updated = 2017-09-18 @@ -867,7 +908,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task"] +searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -878,7 +919,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -890,10 +931,10 @@ Once a phishing message has been detected, the next steps are to answer the foll category = Cloud Security last_updated = 2020-08-05 version = 1 -references = ["https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] +references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -904,11 +945,17 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious mshta spawn - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect mshta renamed - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ -The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. 2. Determine if script code was executed with MSHTA. \ Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ +Triage\ Validate execution \ 1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\ +1. Determine if script code was executed with MSHTA.\ +Situational Awareness\ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSHTA.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is MSHTA loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ The objective of this step is to confirm the executed script code is benign or malicious. [analytic_story://Suspicious Okta Activity] category = Adversary Tactics @@ -917,12 +964,45 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Okta Account Lockout Events - Rule", "ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +searches = ["ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. +[analytic_story://Suspicious Regsvcs Regasm Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + +[analytic_story://Suspicious Regsvr32 Activity] +category = Adversary Tactics +last_updated = 2021-01-29 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/010/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md", "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule"] +description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. +narrative = One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious. + +[analytic_story://Suspicious Rundll32 Activity] +category = Adversary Tactics +last_updated = 2021-02-03 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Suspicious Rundll32 Rename - Rule"] +description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. +narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. + [analytic_story://Suspicious WMI Use] category = Adversary Tactics last_updated = 2018-10-23 @@ -930,7 +1010,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Script Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ @@ -943,7 +1023,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -956,7 +1036,7 @@ version = 1 references = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Get Process File Activity - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Response Task"] description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. @@ -980,12 +1060,22 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious msbuild path - Rule"] +searches = ["ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. -narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. \ -The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution. \ -The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \ -Triage \ Validate execution \ 1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata. 2. Determine if script code was executed with MSBuild. Situational Awareness \ The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe. \ 1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs? 3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \ Retrieval of script code \ The objective of this step is to confirm the executed script code is benign or malicious. +narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ +The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ +The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging msbuild.exe to execute malicious code.\ +Triage\ +Validate execution\ +1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further PE metadata.\ +1. Determine if script code was executed with MSBuild.\ +Situational Awareness\ +The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by MSBuild.exe.\ +1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\ +1. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is MSbuild loading any suspicious .DLLs?\ +1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\ +Retrieval of script code\ +The objective of this step is to confirm the executed script code is benign or malicious. [analytic_story://Unusual AWS EC2 Modifications] category = Cloud Security @@ -994,7 +1084,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \ Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior. @@ -1006,7 +1096,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1030,7 +1120,7 @@ version = 1 references = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jim Apger"}] spec_version = 3 -searches = ["ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] +searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\ @@ -1057,7 +1147,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1068,7 +1158,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1083,7 +1173,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1095,7 +1185,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1106,7 +1196,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1117,7 +1207,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1229,6 +1319,26 @@ annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] +[savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule] +type = detection +asset_type = AWS Federated Account +confidence = medium +explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs +annotations = {"mitre_attack": ["T1078"]} +known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. +providing_technologies = [] + +[savedsearch://ESCU - AWS SAML Update identity provider - Rule] +type = detection +asset_type = AWS Federated Account +confidence = medium +explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. +annotations = {"mitre_attack": ["T1078"]} +known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. +providing_technologies = [] + [savedsearch://ESCU - Abnormally High AWS Instances Launched by User - Rule] type = detection asset_type = AWS Instance @@ -1399,6 +1509,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] +[savedsearch://ESCU - Certutil exe certificate extraction - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. +how_to_implement = +annotations = {"kill_chain_phases": ["Installation"]} +known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. +providing_technologies = [] + [savedsearch://ESCU - Child Processes of Spoolsv exe - Rule] type = detection asset_type = Endpoint @@ -1554,7 +1674,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. -how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files. providing_technologies = [] @@ -1593,10 +1713,10 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = Monitor for signs that Ntdsutil, Vssadmin, or Wmic has been used to create a shadow copy. +explanation = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} -known_false_positives = Legtimate administrator usage of Ntdsutil, Vssadmin, or Wmic will create false positives. +known_false_positives = Legitimate administrator usage of Vssadmin or Wmic will create false positives. providing_technologies = [] [savedsearch://ESCU - Creation of Shadow Copy with wmic and powershell - Rule] @@ -1604,11 +1724,21 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search detects the use of wmic and Powershell to create a shadow copy. -how_to_implement = none +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} known_false_positives = Legtimate administrator usage of wmic to create a shadow copy. providing_technologies = [] +[savedsearch://ESCU - Creation of lsass Dump with Taskmgr - Rule] +type = detection +asset_type = Windows +confidence = medium +explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. +providing_technologies = [] + [savedsearch://ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule] type = detection asset_type = Endpoint @@ -1889,6 +2019,46 @@ annotations = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on known_false_positives = GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours. providing_technologies = [] +[savedsearch://ESCU - Detect HTML Help Renamed - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed hh.exe may be used. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect HTML Help Spawn Child Process - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect HTML Help URL in Command Line - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect IPv6 Network Infrastructure Threats - Rule] type = detection asset_type = Infrastructure @@ -1936,7 +2106,7 @@ confidence = medium explanation = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} -known_false_positives = Other tools can import the same DLLs. These tools should be part of a whtelist. +known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. providing_technologies = [] [savedsearch://ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule] @@ -1954,7 +2124,7 @@ type = detection asset_type = Windows confidence = medium explanation = This search looks for newly created accounts that have been elevated to local administrators. -how_to_implement = none +how_to_implement = You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} known_false_positives = The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives providing_technologies = [] @@ -1984,7 +2154,7 @@ type = detection asset_type = S3 Bucket confidence = medium explanation = This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. providing_technologies = [] @@ -2004,7 +2174,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. -how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. +how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk. providing_technologies = [] @@ -2024,7 +2194,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. -how_to_implement = none +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2069,6 +2239,77 @@ annotations = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation" known_false_positives = Some legitimate processes may be only rarely executed in your environment. As these are identified, update `rare_process_allow_list_local.csv` to filter them out of your search results. providing_technologies = [] +[savedsearch://ESCU - Detect Regasm Spawning a Process - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regasm with Network Connection - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regasm with no Command Line Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvcs Spawning a Process - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvcs with Network Connection - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvcs with No Command Line Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +providing_technologies = [] + +[savedsearch://ESCU - Detect Regsvr32 Application Control Bypass - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ +Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe. +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +known_false_positives = Limited false positives related to third party software registering .DLL's. +providing_technologies = [] + [savedsearch://ESCU - Detect Rogue DHCP Server - Rule] type = detection asset_type = Infrastructure @@ -2079,6 +2320,36 @@ annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissan known_false_positives = This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface. providing_technologies = [] +[savedsearch://ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. +providing_technologies = [] + +[savedsearch://ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use setupapi triggering a false positive. +providing_technologies = [] + +[savedsearch://ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive. +providing_technologies = [] + [savedsearch://ESCU - Detect Rundll32 Inline HTA Execution - Rule] type = detection asset_type = Endpoint @@ -2346,7 +2617,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for fast execution of processes used for system network configuration discovery on the endpoint. -how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. +how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. providing_technologies = [] @@ -2388,7 +2659,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. providing_technologies = [] @@ -2403,6 +2674,28 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Act known_false_positives = None identified. providing_technologies = [] +[savedsearch://ESCU - Dump LSASS via procdump - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (OriginalFileName=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +known_false_positives = None identified. +providing_technologies = [] + +[savedsearch://ESCU - Dump LSASS via procdump Rename - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\ +During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +known_false_positives = None identified. +providing_technologies = [] + [savedsearch://ESCU - EC2 Instance Modified With Previously Unseen User - Rule] type = detection asset_type = AWS Instance @@ -2470,7 +2763,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. -how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} known_false_positives = Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. providing_technologies = [] @@ -2640,7 +2933,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -2960,7 +3253,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. annotations = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} known_false_positives = You will encounter noise from legitimate print-monitor registry entries. providing_technologies = [] @@ -2975,14 +3268,14 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": [" known_false_positives = None at this time providing_technologies = [] -[savedsearch://ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule] +[savedsearch://ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule] type = detection asset_type = Infrastructure confidence = medium explanation = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. +known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search. providing_technologies = [] [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule] @@ -3015,6 +3308,38 @@ annotations = {"cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} known_false_positives = None identified providing_technologies = [] +[savedsearch://ESCU - Ntdsutil export ntds - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ +ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ +This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +known_false_positives = Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives. +providing_technologies = [] + +[savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +providing_technologies = [] + +[savedsearch://ESCU - O365 Added Service Principal - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +providing_technologies = [] + [savedsearch://ESCU - O365 Bypass MFA via Trusted IP - Rule] type = detection asset_type = Office 365 @@ -3045,6 +3370,26 @@ annotations = {"kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110" known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives. providing_technologies = [] +[savedsearch://ESCU - O365 Excessive SSO logon errors - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} +known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack. +providing_technologies = [] + +[savedsearch://ESCU - O365 New Federated Domain Added - Rule] +type = detection +asset_type = Office 365 +confidence = medium +explanation = This search detects the addition of a new Federated domain. +how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. +providing_technologies = [] + [savedsearch://ESCU - O365 PST export alert - Rule] type = detection asset_type = Office 365 @@ -3060,7 +3405,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -3070,7 +3415,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Service Accounts providing_technologies = [] @@ -3080,7 +3425,7 @@ type = detection asset_type = Office 365 confidence = medium explanation = This search detects when multiple user configured a forwarding rule to the same destination. -how_to_implement = none +how_to_implement = annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -3109,7 +3454,7 @@ providing_technologies = [] type = detection asset_type = Infrastructure confidence = medium -explanation = This search detects logins from the same user from different states in a 24 hour period. +explanation = This search detects logins from the same user from different cities in a 24 hour period. how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} known_false_positives = Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint. @@ -3150,7 +3495,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. +how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories. providing_technologies = [] @@ -3210,7 +3555,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for applications on the endpoint that you have marked as prohibited. -how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. +how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = None identified providing_technologies = [] @@ -3240,7 +3585,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -how_to_implement = none +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} known_false_positives = It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate. providing_technologies = [] @@ -3260,17 +3605,17 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} known_false_positives = There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. providing_technologies = [] [savedsearch://ESCU - Registry Keys Used For Privilege Escalation - Rule] type = detection -asset_type = Endpoint +asset_type = confidence = medium explanation = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. providing_technologies = [] @@ -3280,7 +3625,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response products, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications providing_technologies = [] @@ -3330,7 +3675,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search monitors for remote modifications to registry keys. -how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. +how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out. providing_technologies = [] @@ -3413,7 +3758,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. -how_to_implement = none +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. providing_technologies = [] @@ -3523,7 +3868,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for a sharp increase in the number of files written to a particular host -how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response products, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. +how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response product, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} known_false_positives = It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications. providing_technologies = [] @@ -3595,7 +3940,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for files created with names that have been linked to malicious activity. -how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. +how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate. providing_technologies = [] @@ -3640,6 +3985,56 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. providing_technologies = [] +[savedsearch://ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by legitimate processes. +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +known_false_positives = Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 Rename - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the OriginalFileName from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 StartW - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 dllregisterserver - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names. +providing_technologies = [] + +[savedsearch://ESCU - Suspicious Rundll32 no CommandLine Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. +providing_technologies = [] + [savedsearch://ESCU - Suspicious microsoft workflow compiler rename - Rule] type = detection asset_type = Endpoint @@ -3725,7 +4120,7 @@ type = detection asset_type = Windows confidence = medium explanation = Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. -how_to_implement = none +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} known_false_positives = Administrators debugging servers providing_technologies = [] @@ -3762,7 +4157,7 @@ providing_technologies = [] [savedsearch://ESCU - Uncommon Processes On Endpoint - Rule] type = detection -asset_type = Endpoint +asset_type = confidence = medium explanation = This search looks for applications on the endpoint that you have marked as uncommon. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search uses a lookup file `uncommon_processes_default.csv` to track various features of process names that are usually uncommon in most environments. Please consider updating `uncommon_processes_local.csv` to hunt for processes that are uncommon in your environment. @@ -3965,7 +4360,7 @@ type = detection asset_type = Endpoint confidence = medium explanation = The search looks for modifications to the hosts file on all Windows endpoints across your environment. -how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. +how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. annotations = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} known_false_positives = There may be legitimate reasons for system administrators to add entries to this file. providing_technologies = [] diff --git a/package/lookups/rare_process_allow_list_default.csv b/package/lookups/rare_process_allow_list_default.csv index f13f3a18c5..cfc193563d 100644 --- a/package/lookups/rare_process_allow_list_default.csv +++ b/package/lookups/rare_process_allow_list_default.csv @@ -1,4 +1,4 @@ -process,whitelist +process,allow_list splunk-regmon.exe,true winword.exe,true excel.exe,true diff --git a/package/lookups/rare_process_allow_list_local.csv b/package/lookups/rare_process_allow_list_local.csv index 8b3eaefceb..2cca84e0ea 100644 --- a/package/lookups/rare_process_allow_list_local.csv +++ b/package/lookups/rare_process_allow_list_local.csv @@ -1 +1 @@ -process,whitelist +process,allow_list